Retrieving LinkedIn school details, fetching detailed school information containing names,types, geographic locations, and social media links from LinkedIn data. Helpingrecruiters, researchers, and analysts verify educational institutions, research academicnetworks, and enrich institutional data—suitable for degree verification, institutionalresearch, and academic network analysis.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 1.0.5

Overview

The skill mostly performs the advertised paid LinkedIn school lookup, but it also handles API keys, billing/top-up flows, error reporting, and an undisclosed update check in ways users should review carefully.

Review this skill before installing. Use a dedicated low-balance API key, avoid printing the full .env file, confirm any paid query or top-up action separately, and do not include sensitive request or response data in error reports unless you are comfortable sending it to the provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

API Key Exposure Through Full Credential-File Display and Permission-Unsafe Storage

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Installation

Content

View full analysis

=0.23.0 ``` From `SKILL.md:25`: ```markdown 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The dependency specification provides only a lower bound. It allows pip to select any current or future `httpx` release accepted by the resolver, including major versions with incompatible behavior. No lock file, exact version, package hash, or trusted-index restriction is supplied. The documented installation command resolves and downloads packages from the active pip configuration. Consequently, two installations performed at different times or with different index settings may install different artifacts. There is no evidence that the currently named `httpx` package is malicious. The risk arises from mutable and insufficiently verified dependency resolution: a future compromised release, compromised package index, maliciously configured index, or incompatible update could enter the runtime without a change to the audited project. ### Attack Path 1. A user follows the documented setup command. 2. Pip resolves `httpx>=0.23.0` and its transitive dependencies using the configured package index. 3. A future, compromised, substituted, or incompatible artifact satisfies the broad version constraint. 4. Pip installs that artifact into the execution environment. 5. Package installation hooks or imported runtime code execute with the privileges of the user running the Skill. 6. The compromised dependency could access the API key, query data, local files available to that user, or network resources. This path is conditional on compromise or substitution of a dependency source; the audit found no embedded malicious dependency in the repository itself. ### Impact Asse ...[truncated 359 chars]

Remediation

View remediation

other

Note

• Location: scripts/common.py:200

Finding

Undisclosed Automatic Version-Check Request and Persistent Cache Write

Content

View full analysis

Dict[str, Any]: """ 向跨境魔方API发起HTTP请求。 Args: endpoint: API端点路径 params: 请求参数字典 api_key: API密钥（如果为None且require_auth=True，将从环境变量获取） require_auth: 是否需要Bearer令牌认证，默认为True """ check_and_notify(API_BASE_URL) if require_auth and api_key is None: api_key = get_api_key() ``` From `scripts/version_check.py:91-110`: ```python def check_skill_version(skill_name: str, api_base_url: str) -> Optional[str]: """调用 API 检查最新版本""" try: url = f"{api_base_url}/agent/api/skills/version" headers = {"Content-Type": "application/json"} with httpx.Client(timeout=10.0) as client: response = client.post(url, json={"name": skill_name}, headers=headers) response.raise_for_status() data = response.json() if data.get("code") == 0: return data.get("data") except Exception as e: print(f"Error checking skill version:{e}", file=sys.stderr) pass return None ``` From `scripts/version_check.py:132-158`: ```python def check_and_notify(api_base_url: str) -> bool: global _CHECKED_FLAG if _CHECKED_FLAG: return False _CHECKED_FLAG = True skill_name = get_skill_name() if not is_check_needed(skill_name): return False current_version = get_skill_version() latest_version = check_skill_version(skill_name, api_base_url) if latest_version and latest_version != current_version: mark_checked(skill_name, latest_version) no ...[truncated 2191 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks, local metadata parsing, cache writes, and upgrade notifications add hidden network and filesystem behavior unrelated to the advertised lookup task. While not inherently malicious, this undisclosed update-check path expands attack surface and can create unexpected persistence or tracking behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Remote version checks, local metadata parsing, cache writes, and upgrade notifications add hidden network and filesystem behavior unrelated to the advertised lookup task. While not inherently malicious, this undisclosed update-check path expands attack surface and can create unexpected persistence or tracking behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks, local metadata parsing, cache writes, and upgrade notifications add hidden network and filesystem behavior unrelated to the advertised lookup task. While not inherently malicious, this undisclosed update-check path expands attack surface and can create unexpected persistence or tracking behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks, local metadata parsing, cache writes, and upgrade notifications add hidden network and filesystem behavior unrelated to the advertised lookup task. While not inherently malicious, this undisclosed update-check path expands attack surface and can create unexpected persistence or tracking behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The instructions explicitly direct reading a credential file from the user's home directory using cat ~/.upkuajing/.env. Exposing or encouraging direct access to a raw secret store increases the risk of credential disclosure to the agent, logs, or downstream tooling, especially because the skill context is only a school information lookup and does not justify broad secret-file inspection.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill tells the agent to check for a credential in ~/.upkuajing/.env and, if absent, create and save a new key automatically. This combines secret discovery with credential provisioning and local persistence, which is far beyond the least privilege expected for a lookup skill and could lead to unauthorized account creation, secret sprawl, or accidental leakage.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This section again instructs interaction with a local .env credential store and automatic saving of newly created API keys. Repeated emphasis on reading and writing long-lived secrets to a home-directory file materially raises the chance of credential mishandling, especially in an agent setting where file contents may be surfaced to models or logs.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements account authentication, API-key provisioning, balance lookup, and recharge flows that do not align with the stated purpose of LinkedIn school-detail lookup. Capability/purpose mismatch is dangerous because users may invoke a seemingly benign research skill while unknowingly enabling billing or credential-management actions for a third-party service.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This code writes an API key to a plaintext .env file, creating a real credential-exposure risk if the file is readable by other processes/users, backed up insecurely, or accidentally committed. In a misleadingly scoped skill, hidden secret persistence is especially dangerous because users may not realize a new long-lived credential has been stored locally.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Recharge-order creation and pricing/account operations introduce payment-related side effects unrelated to educational institution verification. In the context of a recruiter/research skill, this broadens the trust boundary and creates risk of unexpected charges, misuse of linked accounts, or social-engineering-style abuse under a misleading skill description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements a remote platform error-reporting path that is unrelated to the stated purpose of a LinkedIn school-detail enrichment skill. Capability mismatch is dangerous because it expands the skill's data flows and trust boundaries, creating an undisclosed channel that can transmit operational or user-derived data off-system without clear necessity for the advertised function.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares executable behaviors involving environment access, local file reads/writes, and network usage, but does not declare any explicit tool scope or permissions boundary. That makes the effective capability set opaque to reviewers and increases the chance an agent may perform credential access, persistence, or outbound requests beyond what a user would expect from a simple school lookup skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The API reference explicitly encourages sending requestParams, responseData, and exception context to a centralized error-reporting endpoint, which can include user-supplied content, internal responses, and stack traces. Although the document notes that sensitive fields are 'automatically desensitized,' it does not define guarantees, scope, or user/operator safeguards, so this creates a real risk of privacy leakage or overcollection of sensitive data during failure handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code can provision a new API credential and persist it locally even though the skill is presented as a LinkedIn school lookup tool. This is risky because it collects and stores long-lived credentials under a misleading context, increasing the chance users authorize or retain secrets they did not expect to create.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script writes a newly issued API key directly to a local .env file without an upfront warning or confirmation before the sensitive write occurs. This can expose credentials through weak file permissions, accidental check-in, local disclosure, or user confusion about where secrets are stored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file’s user-facing natural language is entirely in Chinese, beginning with the module description and continuing through comments and console messages. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless a justified region-specific constraint is documented, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60