手机号有效性校验，验证电话号码有效、无效、座机、手机、是否注册WhatsApp多种状态，帮助销售团队、招聘人员、贸易商、外贸从业者检查手机号真实性、减少无效联系人、提升客户触达效率——是 CRM 数据清洗、候选人筛查、供应商核验的必备工具，适用于外贸短信群发前清洗、招聘背调与采购商核实。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.2

Overview

This is a disclosed paid phone-validation client; it uses credentials, remote API calls, billing helpers, and optional error reporting in ways that are mostly coherent with that purpose.

Install only if you are comfortable sending phone numbers to Upkuajing's remote API and storing an API key under ~/.upkuajing/.env. Confirm paid calls and recharge actions yourself, and avoid including phone numbers, secrets, or full request/response bodies in optional error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit permissions while its documentation clearly instructs access to environment variables, local files under the user's home directory, and remote network APIs. This creates a transparency and consent problem: a host or user may authorize the skill based on incomplete capability disclosure, increasing the chance of unintended credential, file, or network access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The stated purpose is phone validation, but the documented behavior expands into API-key provisioning, local credential storage, account/billing operations, pricing queries, error reporting, and version-check/caching behavior. This mismatch is dangerous because users may invoke the skill for low-risk validation while unintentionally enabling higher-risk actions involving credentials, payments, telemetry, and persistent local state.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account authentication, API key issuance, balance lookup, pricing lookup, and recharge order creation for a third-party platform, which is materially different from the advertised phone-validity and WhatsApp-checking purpose. This kind of scope mismatch is dangerous because it grants the skill access to billing and credential-management capabilities users would not reasonably expect, increasing the risk of unauthorized account actions and hidden monetization paths.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The recharge-order creation function enables a payment workflow unrelated to phone validation. In the context of a contact-verification skill, exposing payment initiation is risky because it creates an unnecessary financial action surface that could be abused or trigger unintended charges if invoked by an agent or user expecting only validation features.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill exposes account balance and platform pricing queries that are not directly necessary for phone-number validity checks. While not inherently malicious, these extra capabilities broaden access to sensitive business/account information and indicate privilege creep inconsistent with the declared skill purpose.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script sends exception data to a remote platform endpoint even though the advertised skill purpose is phone/WhatsApp validation, not telemetry collection. This creates an additional data-flow channel that may transmit request metadata and context during failures, which can expose sensitive operational or customer information if users/operators are not aware of it.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module adds network egress to a version-check endpoint and writes persistent state under the user's home directory, which is unrelated to the stated phone-validation function of the skill. Even if framed as update checking, undisclosed outbound requests and local caching expand the attack surface, create privacy/telemetry concerns, and can be abused if the API base URL is attacker-controlled or if users are not expecting the skill to perform side-effecting background activity.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes sending phone numbers with bearer-token-authenticated requests to an external API but does not warn users that personal contact data will be transmitted off-platform. This creates a real privacy and data-handling risk because operators may use the skill without informed consent, proper disclosure, or review of third-party processing and retention practices.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs agents to report exceptions to a remote API and explicitly allows inclusion of request parameters, response data, and error context. Even though it says sensitive fields will be automatically redacted, this still creates a path for potentially sensitive customer data, identifiers, stack traces, and model inputs/outputs to be transmitted off the primary execution path without any clear user-facing disclosure, data minimization rules, or prohibition on sending secrets. In a phone-validation skill, those payloads may contain phone numbers and related contact metadata, making the privacy risk more concrete.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `make_request('/agent/skill/error/report', params)` transmits error-report data externally without any visible warning, consent flow, or redaction controls in this file. Because `params` includes `requestId`, `requestPath`, and free-form `context`, exceptions could leak customer data, request contents, or internal metadata to a remote service during error handling.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code sends phone numbers to a remote validation endpoint via make_request('/agent/validation/phone', params) without any visible consent prompt, privacy notice, masking, or minimization in this file. Because phone numbers are personal data and the skill explicitly checks WhatsApp registration status, the privacy sensitivity is elevated and users may unknowingly disclose contact data to a third-party service.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 91% confidence
• Finding: The skill instructs checking and using a credential file in ~/.upkuajing/.env and supports automatically obtaining and saving a new API key there. Accessing and modifying credential stores is sensitive because it exposes secrets to the skill flow and creates persistent authentication material on disk, which can be misused by the skill itself or other local processes if protections are weak.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 90% confidence
• Finding: The documented flow allows the skill to request a new API key and automatically save it into ~/.upkuajing/.env, extending its role from phone validation into credential lifecycle management. This is risky because it gives the skill a path to create and persist fresh credentials, increasing blast radius if the skill is abused or if users do not understand that a long-lived secret is being stored locally.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: The code writes the issued API key in plaintext to a .env file, which can expose the credential if the file permissions are weak, the host is shared, or the file is later committed, backed up, or read by other local processes. Storing long-lived secrets unencrypted in predictable locations increases the blast radius of local compromise.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 79% confidence
• Finding: The failure path encourages manual setting of the API key as an environment variable and returns the env file path, reflecting a broader secret-handling workflow centered on plaintext/local exposure rather than secure storage. While not direct exfiltration, this pattern contributes to insecure secret lifecycle management in a skill whose advertised purpose does not suggest credential administration.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer major or minor versions with unintended behavioral changes or newly introduced supply-chain risk. While this is not an immediate exploit by itself, it weakens build reproducibility and can expose the skill to unexpected vulnerable or incompatible releases over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196