LinkedIn 人员搜索，按姓名、公司、职位与行业从 LinkedIn 数据找人。帮助招聘人员、销售团队与 B2B 线索构建者发掘 LinkedIn档案、寻源候选人、丰富联系数据——适合人才获取、猎头、候选人筛选与国际线索生成。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:52 AM UTC
• Version: 1.0.3

Overview

This is a disclosed paid LinkedIn-data search skill that uses Upkuajing APIs, with notable but purpose-aligned handling of API keys, billing, remote requests, and saved search results.

Install only if you are comfortable using Upkuajing’s paid API for LinkedIn-derived person searches. Protect ~/.upkuajing/.env as a secret, confirm costs before searches, avoid sending sensitive details in error reports, and delete task_data results when no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes capabilities beyond simple search, including reading environment variables, writing local files, and making network requests, yet it declares no explicit permissions or scoped access model. This creates a transparency and trust problem: users may authorize a people-search skill without realizing it can persist secrets locally and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose is LinkedIn person search, but the skill also performs account provisioning, local credential storage, balance checks, payment order creation, pricing lookups, error reporting, and version-check caching. This mismatch increases the risk of deceptive or surprising behavior, especially because several side actions affect billing, credentials, and external data transfer beyond the user’s expected search task.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This code can automatically request a new API key and persist it locally, which materially expands the skill from search into credential lifecycle management. In the context of a user-facing search skill, embedding credential issuance and storage increases the risk of unauthorized key creation, accidental disclosure, and misuse if the local environment or skill distribution is not tightly controlled.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata claims it relies on LinkedIn data, but the code hardcodes requests to a different third-party service (openapi.upkuajing.com). This is a supply-chain/transparency issue: users may disclose search targets and business contact data under false assumptions about source, consent, or contractual controls, which can create privacy, compliance, and trust risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The reference explicitly exposes filters and result fields for personal contact data such as phone, email, WhatsApp, website, social accounts, and gender, but provides no privacy notice, lawful-use constraints, consent requirements, or handling guidance. In a lead-generation and recruiting context, this can enable bulk discovery and processing of personal data for profiling, outreach, or scraping-like enrichment without clear safeguards, increasing privacy, compliance, and abuse risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and error context to a centralized error-reporting API, but it does not require explicit minimization, user notice, or operator confirmation before potentially sensitive business or personal data is transmitted. Although it mentions that sensitive fields will be automatically masked, that control is unspecified and may not cover all secrets, identifiers, prompts, or third-party personal data contained in requestParams, responseData, or stack traces.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The request/response logging functions write full API parameters and full API responses to local log files when enabled, without redaction. Because this skill processes person-search queries and may receive profile/contact data, logs can persist sensitive business intelligence or personal data on disk where other local users, backups, or support tooling may access it.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function sends request metadata and arbitrary 'context' to a remote endpoint, and the context may contain stack traces, user inputs, identifiers, or other sensitive operational data. Because this file performs transmission without local minimization, redaction, or visible consent/disclosure controls, it creates a real risk of unintended data leakage to the platform operator.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script forwards user-supplied LinkedIn person-search parameters directly to a remote API, which can include personal or sensitive targeting data such as names, employers, titles, and locations. In a people-search/recruiting context, transmitting such data without an explicit privacy notice, consent guidance, or data-handling disclosure increases the risk of unauthorized personal-data processing and user misunderstanding about where their inputs are sent.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs the agent to read `~/.upkuajing/.env` to check for an API key and to manage secret presence from a local credential file. Accessing local secret stores is sensitive because it can expose credentials unnecessarily to the skill flow, and the same mechanism can be abused to harvest or mishandle secrets unrelated to the immediate user request.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: The skill can apply for a new API key and automatically save it into `~/.upkuajing/.env`, which combines credential creation with local secret persistence. Automatic writing of newly issued credentials to a generic dotfile increases the attack surface for secret leakage, accidental reuse by other processes, and unauthorized billing on the associated account.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 91% confidence
• Finding: The function is designed to inspect a local .env file for an existing API key, indicating that credentials are handled via plaintext environment files. Storing and managing API secrets in a predictable local file raises the risk of credential theft through local compromise, accidental inclusion in backups, or leakage via misconfigured permissions.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 92% confidence
• Finding: Reading the entire .env file to extract an API key confirms that secrets are expected to reside in plaintext on disk. In a skill package unrelated to credential administration, this increases the chance that sensitive tokens are exposed to other local users, logs, backups, or accidental source control commits.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 97% confidence
• Finding: The code writes the newly issued API key directly into a .env file in plaintext. Plaintext persistence of active API credentials creates a straightforward credential-compromise path if the host is shared, the home directory is synced/backed up, or the file is later copied or committed inadvertently.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound constraint (httpx>=0.23.0) instead of pinning to an exact version, which allows different installations to resolve to different package versions over time. This increases supply-chain and stability risk because a future vulnerable or incompatible release could be pulled in automatically without review, though the presence of only a common HTTP client library makes the immediate impact relatively limited in this file alone.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196