Retrieving LinkedIn school details, fetching detailed school information containing names,types, geographic locations, and social media links from LinkedIn data. Helpingrecruiters, researchers, and analysts verify educational institutions, research academicnetworks, and enrich institutional data—suitable for degree verification, institutionalresearch, and academic network analysis.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:46 AM UTC
• Version: 1.0.5

Overview

This is a real paid LinkedIn school-detail lookup, but it also handles API keys, account/payment flows, error reporting, and version checks in ways users should review before installing.

Install only if you are comfortable using UpKuaJing as the data provider, paying per API call, storing its API key in ~/.upkuajing/.env, and letting the skill contact the provider for lookup, account, pricing, diagnostics, and version-check requests. Confirm charges and error reports explicitly, and avoid sending sensitive prompt or user data in diagnostic context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading and writing local credential files, accessing environment variables, and making network requests. This creates a transparency and consent problem: an operator may invoke a seemingly simple lookup skill without realizing it can touch secrets, persist credentials, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a LinkedIn school-detail lookup, but it also includes account provisioning, balance checks, payment/top-up workflow, pricing lookup, and error reporting to the platform. This mismatch increases the risk of over-collection, unexpected outbound actions, and social-engineering users into credential setup or payment flows under the guise of a simple data-enrichment task.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is an authentication and billing-management script embedded in a skill advertised as LinkedIn school-detail lookup and institution verification. This scope mismatch is dangerous because it introduces unrelated account-creation, payment, and credential-handling capabilities that expand attack surface and can mislead users into authorizing sensitive operations they did not expect from the skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Creating recharge/payment orders is unrelated to school-detail retrieval and gives the skill the ability to initiate monetization workflows. In the context of a recruiter/research enrichment skill, this is especially risky because users may not expect financial operations and could be tricked into funding third-party accounts.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script exposes account-information and pricing-management style functions that are not necessary for LinkedIn school-detail retrieval. These extra capabilities leak business/account metadata and enlarge the operational scope of the skill beyond its declared purpose, increasing the chance of misuse or social engineering.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The utility module is wired to an unrelated third-party service (`openapi.upkuajing.com`) and associated credential namespace instead of LinkedIn school-detail retrieval. In a skill whose declared purpose is LinkedIn education enrichment, this mismatch is a strong indicator of capability drift or hidden data exfiltration to an unexpected external service, increasing supply-chain and privacy risk.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This file implements generic error-reporting to an external platform, which is unrelated to a LinkedIn school-detail data skill and therefore expands the skill’s behavior beyond its stated purpose. Such out-of-scope telemetry is dangerous because it can exfiltrate request metadata and free-form context during failures, creating an unexpected data flow that users and reviewers may not anticipate.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module performs outbound network communication to a remote API and writes persistent state under the user's home directory, even though the skill is described as a LinkedIn school-detail enrichment tool. That mismatch expands the skill's behavior beyond user-expected functionality and creates supply-chain and telemetry risk, because a skill can beacon externally and persist metadata without a clear business need or consent boundary.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code implements self-update/version-telemetry behavior by posting the skill name to a server-side endpoint unrelated to the advertised LinkedIn school lookup purpose. Even though it does not directly execute updates, silent background version checks can leak usage information and establish an unnecessary control channel to external infrastructure.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list is broad enough that the skill could activate for general education verification or institutional research requests without clear boundaries. In context, that is risky because activation may lead users into fee-incurring queries, credential handling, or ancillary account actions they did not intend to authorize.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and exception context to a central error-reporting API, which can contain user data, model inputs, stack traces, identifiers, or other sensitive system information. Although it mentions automatic masking of sensitive fields, there is no explicit requirement for user consent, minimization, field allowlisting, or guarantees that all sensitive content in free-form context and payloads will be redacted, creating a real risk of unintended data exfiltration to the platform.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends caller-supplied requestId, requestPath, context, skillId, and skillVersion to a remote endpoint without any visible consent, redaction, or validation. Because 'context' is free-form and likely to contain error details, prompts, identifiers, or other sensitive operational data, this creates a direct risk of unintentional data leakage to an external service.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs reading `~/.upkuajing/.env` and storing an API key there, including automated key creation and persistence. Accessing and modifying a local secrets file exposes credentials to mishandling, creates a path for secret exfiltration or overwrite, and expands the skill from data lookup into credential management.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: This section continues the credential-handling flow by checking for `UPKUAJING_API_KEY`, prompting the user to provide one, or automatically obtaining and saving a new key to `~/.upkuajing/.env`. That behavior materially increases risk because it normalizes local secret-file access and persistent credential writes inside a skill whose stated purpose is school-detail lookup.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: The script writes a newly issued API key to a plaintext .env file in a user directory, which risks local disclosure through weak file permissions, backups, logs, or other processes reading the file. In a skill that is not expected to manage credentials at all, this is more concerning because it quietly persists sensitive material outside the stated LinkedIn lookup purpose.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 72% confidence
• Finding: The error path encourages manual setting of the API key environment variable and returns the env file path, reflecting insecure secret-handling practices around credential persistence. While not exfiltration by itself, it normalizes weak handling of secrets and can expose operational details useful to an attacker with local access.

Credential Access

High

• Category: Privilege Escalation

Content

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

• Confidence: 88% confidence
• Finding: The module is designed to read credentials from a user home-directory `.env` file tied to an unrelated service. In the context of a LinkedIn school-detail skill, accessing local secret material for a different provider is suspicious and can enable misuse of user-managed API credentials, especially when combined with outbound network requests to that provider.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

• Confidence: 88% confidence
• Finding: `load_env_file()` explicitly parses `~/.upkuajing/.env`, which is credential-loading behavior for an external service unrelated to the declared functionality. In this context, local secret access expands the trust boundary and risks unauthorized use of stored API keys for hidden outbound activity.

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key() -> str:
    """
    获取API密钥，优先从环境变量，其次从 ~/.upkuajing/.env 文件。
    """
    # 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

• Confidence: 86% confidence
• Finding: The `get_api_key()` routine is dedicated to resolving credentials for the unrelated Upkuajing service, including fallback to a local `.env` file. Within this skill context, that behavior is dangerous because it operationalizes credential access and use for a service outside the advertised purpose.

Credential Access

High

• Category: Privilege Escalation

Content

# 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

    # 如果环境变量没有，尝试从 ~/.upkuajing/.env 读取
    if not api_key:
        env_vars = load_env_file()
        api_key = env_vars.get(API_KEY_ENV)

• Confidence: 87% confidence
• Finding: The fallback branch that loads the API key from the local `.env` file materially enables credential harvesting/use beyond environment-based injection. Given the skill mismatch and downstream network calls, this makes the skill more dangerous by increasing the chance it can silently leverage user-resident secrets.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: The dependency is specified with a lower-bound range (`httpx>=0.23.0`) rather than an exact version, which makes installs non-reproducible and allows future releases to be pulled in without review. This can introduce breaking changes or vulnerable/transitively compromised versions into the skill's environment, especially in automation contexts where dependency resolution happens unattended.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60