Pinpointing LinkedIn personnel, locating individuals from LinkedIn data by name, company,job title, and industry. Helping recruiters, sales teams, and B2B lead-generationspecialists discover LinkedIn profiles, source candidates, and enrich contactdata—suitable for talent acquisition, headhunting, candidate screening, and internationallead generation.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.3

Overview

The skill appears to perform paid LinkedIn people search as described, but it needs review because it handles API keys unsafely and processes sensitive people/contact data.

Review before installing. Only use this skill if you trust UpKuaJing with your searches and account data, understand that API calls may incur fees, and have a lawful basis for processing LinkedIn-derived people/contact data. Do not print or paste `~/.upkuajing/.env`; prefer a protected environment variable or secret store, and if using the file, restrict `~/.upkuajing` and `.env` to owner-only permissions. Avoid sending raw request parameters, responses, profile data, or credentials in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API Key Stored Without Enforced Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Documentation Instructs the Agent to Print the Credential File

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

=0.23.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement specifies only a minimum version and accepts any future release of `httpx`. No lockfile or package hashes are supplied. Consequently, installations performed at different times may resolve to different direct and transitive dependency versions. This is not evidence that the current `httpx` package is malicious. The risk is that the reviewed project does not constrain the code that will ultimately be installed. A compromised future release, compromised transitive dependency, or incompatible version could therefore enter the runtime without a corresponding change to this repository. Because Python package installation may execute build-system code, dependency compromise can affect the local environment at installation time, subject to the privileges of the user running `pip`. ### Attack Path 1. A user follows `SKILL.md` and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest available version satisfying `httpx>=0.23.0`, together with its current transitive dependencies. 3. A future direct or transitive release is compromised, malicious, or incompatible. 4. The unreviewed package is downloaded and installed. 5. Malicious build or runtime code executes with the privileges of the user running the installation or the Skill. This path depends on a package-source or dependency compromise; the audited repository itself does not contain evidence of such a compromise. ### Impact Assessment If the dependency supply chain is compromised, attacker-controlled code could run with the permissions of the installation or Skill process. That may expose local files available to that user, including the ...[truncated 258 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose does not mention remote version checks, local metadata parsing, or version cache file reads/writes. These undeclared behaviors expand the attack surface and can surprise users or reviewers, especially when combined with network and filesystem access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose does not mention remote version checks, local metadata parsing, or version cache file reads/writes. These undeclared behaviors expand the attack surface and can surprise users or reviewers, especially when combined with network and filesystem access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose does not mention remote version checks, local metadata parsing, or version cache file reads/writes. These undeclared behaviors expand the attack surface and can surprise users or reviewers, especially when combined with network and filesystem access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose does not mention remote version checks, local metadata parsing, or version cache file reads/writes. These undeclared behaviors expand the attack surface and can surprise users or reviewers, especially when combined with network and filesystem access.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs reading ~/.upkuajing/.env directly, including an example using cat, which can expose the full API key value to the agent, logs, or user-visible output. Credential material should not be displayed or broadly read unless strictly necessary, because compromise of the API key can enable unauthorized use, billing abuse, and access to associated account functions.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The workflow directs checking the user's ~/.upkuajing/.env and potentially writing a provided or newly created API key there. This creates a direct credential-handling path in a skill whose main advertised function is search, increasing the risk of secret exposure, accidental overwrite, insecure storage, or misuse of billing-enabled credentials.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Automatically saving a newly applied API key into ~/.upkuajing/.env couples network-based key issuance with local plaintext credential persistence. In the context of a lead-generation/search skill, this is more dangerous because users may not expect credential enrollment and local secret storage as part of ordinary search operations.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements API-key issuance, account lookup, pricing, and recharge flows for a third-party service, which is materially unrelated to the declared LinkedIn people-search purpose. In a skill presented as lead-search/headhunting functionality, this mismatch is dangerous because it can conceal undisclosed monetization, account-linking, or external platform dependency that users did not consent to.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

Writing an API key in plain text to a .env file under the user's home directory creates a local secret-exposure risk if file permissions are weak, backups are shared, or other processes/users can read the file. In combination with an unrelated skill context, this undisclosed credential persistence increases the risk of hidden long-lived access to an external platform.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script reports execution metadata and arbitrary error context to a remote platform endpoint, and that behavior is unrelated to the declared LinkedIn person-search purpose of the skill. In a lead-generation/headhunting context, the reported request identifiers, paths, and context may contain sensitive operational data or user/business information, creating an unnecessary data-exfiltration channel.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares executable behaviors involving environment access, local file reads/writes, and network use, but does not declare any tool scope or permission boundaries. That makes the effective trust boundary opaque, increasing the chance of unintended credential access, filesystem interaction, or outbound requests without clear review or runtime restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger list is broad and includes generic lead-generation and targeting phrases that could invoke the skill in contexts broader than the user intended. Because the skill can touch credentials, billing flows, and external APIs, accidental invocation has more consequence than a purely informational tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction says industry names must be in English, which is a language constraint presented as a requirement rather than a user choice. There is no opt-in, alternative language handling, or documented justification for forcing English input in this skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The notes section repeats that industry names must be in English, again imposing a specific language requirement without offering the user a choice or documenting a justified regional limitation. This is a natural-language policy issue because it constrains user language unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API reference explicitly supports filtering for the existence of phone numbers, WhatsApp, email, websites, and social accounts, which enables targeted discovery of individuals with reachable contact data. In the stated context of headhunting, lead generation, and contact-data enrichment, exposing this capability without any privacy, lawful-basis, anti-spam, or sensitive-data handling guidance materially increases the risk of misuse for unsolicited outreach, scraping, profiling, or privacy-invasive targeting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented response fields include demographic and person-profile attributes such as gender, country, job titles, industries, work-history counts, and multiple contact-signal indicators. Providing these profiling attributes in a people-search skill for global lead generation and executive targeting, without any warning about sensitivity, discrimination risk, or appropriate use, creates a meaningful risk of invasive profiling, biased targeting, and privacy harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly encourages sending request parameters, response payloads, and exception context to an error-reporting endpoint, and although it mentions automatic masking of sensitive fields, it does not define what is masked or require minimization before transmission. In a lead-generation/headhunting skill that may process personal and contact data, this can result in unintended disclosure of personal data, tokens, query terms, or internal error details to logging infrastructure without clear user awareness or strict scoping.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s user-facing description and CLI help/messages are entirely in Chinese, indicating the skill is designed to operate in a single language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.