Pinpointing LinkedIn personnel, locating individuals from LinkedIn data by name, company,job title, and industry. Helping recruiters, sales teams, and B2B lead-generationspecialists discover LinkedIn profiles, source candidates, and enrich contactdata—suitable for talent acquisition, headhunting, candidate screening, and internationallead generation.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:38 AM UTC
• Version: 1.0.3

Overview

The skill provides the advertised LinkedIn search, but it also handles paid-account credentials, top-up flows, stored search results, and under-disclosed vendor calls that users should review before installing.

Install only if you trust UpKuaJing with LinkedIn search queries and returned contact/profile data. Use a dedicated API key, avoid shared machines for the plaintext ~/.upkuajing/.env credential, confirm expected fees before searches or top-ups, and do not approve error reports that include raw personal data, secrets, or full API responses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation indicates use of environment variables, local file reads/writes, and network access, but it does not declare corresponding permissions. This creates a transparency and consent problem: operators may invoke a skill believing it is narrow-scope search functionality when it can also access credentials, persist data, and make outbound requests. In an agent setting, undeclared capabilities increase the risk of over-privileged execution and surprise data handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose is LinkedIn person search, but the skill also instructs the agent to create and store API keys, inspect account information, create recharge/payment orders, query pricing, report errors to the vendor, and persist task metadata/results. This mismatch is dangerous because users and orchestration layers may authorize the skill for simple search while it performs billing-related, credential-related, and data-exfiltrating side actions that have different risk profiles.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements account registration, balance lookup, pricing, and payment-order creation for a third-party service ('跨境魔方'), which does not match the declared LinkedIn people-search purpose. This kind of capability mismatch is dangerous because it can hide unrelated external-service onboarding and monetization flows inside a skill users may trust for a very different task, increasing the risk of deceptive data handling and unexpected network activity.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script can create recharge/payment orders via a remote API even though the stated skill purpose is LinkedIn profile search. Embedding billing setup in an unrelated lead-generation skill can surprise users, facilitate unwanted charges or payment redirection, and indicates the skill may be acting beyond expected scope.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module performs behavior outside the skill's declared LinkedIn search and profile-enrichment purpose: it makes outbound network requests to a version API and writes persistent state under the user's home directory. While likely intended for maintenance, this expands the skill's trust boundary, introduces undeclared telemetry/statefulness, and creates an additional channel that could be abused if the API base URL is untrusted or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The self-update/version-check logic is not necessary to fulfill the stated function of searching LinkedIn professionals, so it represents unnecessary capability. Unnecessary remote-check features increase attack surface and can enable hidden communications or future abuse even if the current payload is limited to the skill name.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger phrases include broad terms such as global lead generation and executive headhunting, which can cause the skill to activate for loosely related requests outside a narrowly scoped LinkedIn-search workflow. Over-broad activation increases the chance of unintended execution of a fee-incurring, networked skill that handles contact-data enrichment and account operations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and detailed error context to a centralized error-reporting API, but it does not require explicit minimization, user notice, or strict redaction before transmission. In the context of a LinkedIn people-search and contact-enrichment skill, those fields can plausibly contain personal data, search targets, internal prompts, API responses, or authentication-adjacent metadata, creating a meaningful privacy and data-exposure risk if over-collected or mishandled.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code writes a newly issued API key directly to a local .env file without prompting the user, confirming storage location, or setting restrictive permissions. Persisting credentials silently increases the chance of accidental exposure through backups, shared home directories, source-control mistakes, or other local processes reading the file.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: Creating a recharge order triggers an external payment-related API call without a user-facing warning or explicit confirmation in this code path. While not a direct exploit primitive, it can cause unexpected external payment-flow setup and contributes to deceptive or non-transparent behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request/response logging functions can persist full transmitted parameters and API responses to local files, which may include personal data, search targets, or returned profile details. Although logging is disabled by default, enabling it would create silent local data retention without redaction or consent controls, increasing privacy and compliance risk in a lead-generation/headhunting context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function sends a caller-supplied `context` field, along with request identifiers and paths, to a remote endpoint via `make_request('/agent/skill/error/report', params)` without any visible sanitization, minimization, or user disclosure in this file. If `context` contains stack traces, prompts, tokens, personal data, or LinkedIn-derived lead information, sensitive data could be exfiltrated to the platform during error handling.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code sends the skill name to a remote server without any user-facing disclosure in this file, creating an undisclosed outbound data flow. Although the transmitted field is low sensitivity, hidden telemetry is still a privacy/transparency issue and may be more concerning because it occurs in a skill whose stated purpose is unrelated to version telemetry.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 92% confidence
• Finding: The skill explicitly instructs checking and using a credential file in ~/.upkuajing/.env and to add or automatically save API keys there. In an agent environment, directing file inspection and credential persistence increases the chance of secret exposure, mishandling, or unauthorized reuse, especially because the same skill also performs network operations and vendor reporting. The context makes this more dangerous because credentials are tied to paid API usage and account actions.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 91% confidence
• Finding: This section continues the credential-handling flow by proposing that a new API key be created and automatically written to ~/.upkuajing/.env. Automatic creation and storage of secrets in a local file broadens credential exposure and can lead to unintended account usage or abuse if the environment is shared, logged, or insufficiently isolated. Because the skill also supports top-up and account operations, compromise of the key has direct financial and data-access consequences.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: This code path stores a live API key into a local .env file, creating a credential-at-rest exposure surface. Even without exfiltration, writing secrets to plaintext files can enable later compromise by other users, processes, backups, or accidental publication.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer unreviewed versions of httpx. This creates a supply-chain risk where breaking changes or a compromised upstream release could be pulled into the skill unexpectedly, which is especially relevant for a network-facing skill that performs external lookups.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58