T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:45- Finding
Unsafe API Key Display and Insufficient Local File Permission Enforcement
- Content
View full analysis
- Remediation
View remediation
Security audit
手机号有效性校验，验证电话号码有效、无效、座机、手机、是否注册WhatsApp多种状态，帮助销售团队、招聘人员、贸易商、外贸从业者检查手机号真实性、减少无效联系人、提升客户触达效率——是 CRM 数据清洗、候选人筛查、供应商核验的必备工具，适用于外贸短信群发前清洗、招聘背调与采购商核实。
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its phone-validation purpose, but it handles API keys, billing flows, and update checks in ways users should review carefully before installing.
Review this skill before installing. Use it only if you trust the Upkuajing service with the phone numbers you submit and with a paid API key. Do not print ~/.upkuajing/.env in terminal output or chat; store the key with restrictive file permissions, rotate it if exposed, and require explicit confirmation before any paid validation or recharge action.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependency Version
- Content
View full analysis
=0.23.0 ``` Related installation instruction at `SKILL.md:22`: ```markdown 2. **安装依赖**：`pip install -r requirements.txt` ``` ### Technical Analysis The dependency declaration establishes only a minimum version and permits installation of any later `httpx` release. Consequently, the code reviewed during this audit may execute with a substantially different future package version. This prevents reproducible dependency resolution and creates exposure to: - A future compromised package release. - A release containing a security regression. - Breaking changes that alter TLS, proxy, redirect, or request behavior. - Unreviewed changes in transitive dependencies. No evidence was found that the current `httpx` package name is a typosquat or that a malicious package is presently included. The risk arises from allowing future, unaudited versions to be selected automatically. ### Attack Path A successful exploitation path requires a malicious or vulnerable future dependency release: 1. An attacker compromises the package publishing process, a maintainer account, or another relevant supply-chain component. 2. A later version satisfying `httpx>=0.23.0` is published. 3. A user installs the Skill dependencies without a previously generated lock file or hash verification. 4. `pip` resolves and installs the affected release. 5. The Skill imports `httpx` in `scripts/common.py` and `scripts/version_check.py`. 6. Malicious package initialization or runtime behavior executes with the privileges of the user running the Skill. 7. That code could access process environment variables, including `UPKUAJING_API_KEY`, read user-accessible files, or alter network requests. ### Impact Assessment ...[truncated 701 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (39)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation indicates the skill may perform version checks, read local files, write a version cache, contact a remote version endpoint, and emit upgrade notices—behavior unrelated to core phone validation. Undisclosed background network activity and local writes expand the trust boundary and can expose metadata or create unwanted persistence without clear user awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation indicates the skill may perform version checks, read local files, write a version cache, contact a remote version endpoint, and emit upgrade notices—behavior unrelated to core phone validation. Undisclosed background network activity and local writes expand the trust boundary and can expose metadata or create unwanted persistence without clear user awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation indicates the skill may perform version checks, read local files, write a version cache, contact a remote version endpoint, and emit upgrade notices—behavior unrelated to core phone validation. Undisclosed background network activity and local writes expand the trust boundary and can expose metadata or create unwanted persistence without clear user awareness.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation indicates the skill may perform version checks, read local files, write a version cache, contact a remote version endpoint, and emit upgrade notices—behavior unrelated to core phone validation. Undisclosed background network activity and local writes expand the trust boundary and can expose metadata or create unwanted persistence without clear user awareness.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill instructs reading the full contents of ~/.upkuajing/.env using cat, which can expose the API key and potentially other secrets stored in that file. Directly surfacing secret material to the agent or user interface increases the risk of credential leakage, reuse, or accidental logging.
- Content
使用此技能需要API密钥。API密钥保存在
~/.upkuajing/.env文件中：bash cat ~/.upkuajing/.env文件内容示例：
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill's setup flow explicitly involves checking a local secret file for an API key and then potentially initiating key provisioning that writes credentials back to disk. This expands the skill from validation into credential acquisition and storage, increasing the chance of secrets being exposed, mishandled, or persisted insecurely.
- Content
md ### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
Automatically applying for a new API key and saving it into ~/.upkuajing/.env introduces credential creation and persistence inside a skill whose main purpose is phone checking. If exploited or misused, this could create unauthorized accounts, store secrets in predictable locations, and expose credentials through logs, backups, or later file reads.
- Content
md 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements account onboarding, API key issuance, balance lookup, recharge order creation, and pricing retrieval, which materially exceeds the stated skill purpose of phone-number validity and WhatsApp-status checking. This scope expansion increases attack surface and can enable unauthorized billing, credential provisioning, or account manipulation pathways unrelated to the advertised function.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
The function writes a newly issued API key directly into a plain-text .env file under the user's home directory. Storing long-lived credentials in plain text increases the chance of disclosure through weak filesystem permissions, backups, logs, support bundles, or other local processes, especially in a skill whose advertised purpose does not require secret-management behavior.
- Content
python "envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises executable behavior that can read environment variables, access local files, write to disk, and make network requests, but it does not declare any explicit tool scope or permission boundaries. This weakens user and platform visibility into what the skill may access, increasing the chance of over-privileged execution or unintended sensitive-data exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file’s user-facing instructions and descriptions are exclusively in Chinese, and nowhere does it indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in the skill description. The document instructs users to send an Authorization token and a list of phone numbers, which are sensitive credentials and personal data, but it provides no warning about privacy, secure handling, or transmission implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document explicitly instructs sending request parameters, response payloads, and error context to a centralized error-reporting API. Although it notes that sensitive fields are 'automatically masked,' it does not define the masking scope, guarantee coverage for all secrets/PII, or instruct operators to minimize or avoid sending user data, which creates a realistic risk of privacy leakage through logs and telemetry.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s user-facing description, CLI help text, and status/error messages are entirely in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code can request a new API key and persist it locally, which is an account bootstrap capability rather than core phone-verification logic. In a skill that users expect only to validate phone numbers, automatic credential provisioning broadens trust assumptions and can lead to unintended account creation or secret handling exposure.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Creating recharge orders and exposing pricing APIs are monetization/account-management capabilities unrelated to phone validation. In the context of a narrowly described validation skill, hidden billing functionality is risky because it may surprise users, facilitate unwanted charges, or normalize overprivileged agent behavior.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/common.py:196