It validates phone-number status including valid, invalid, landline, mobile andWhatsApp-registered statuses. It helps sales teams, recruiters, traders and exportersverify phone-number authenticity, cut invalid contacts and boost outreach efficiency. Thisessential tool supports CRM data cleansing, candidate screening and supplier verification.It works for pre-send cleanup for bulk foreign-trade SMS, recruitment background checksand buyer validation.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.2

Overview

This phone-validation skill is coherent and disclosed overall, but users should understand it uses a paid external API and stores an API key locally.

Install only if you are comfortable sending phone numbers and WhatsApp-status checks to Upkuajing's API and using a paid account. Prefer setting UPKUAJING_API_KEY through a secure environment or secrets manager; if using ~/.upkuajing/.env, restrict its permissions and avoid putting customer records or tokens into error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API Key Stored Without Explicitly Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependency Uses an Unbounded Minimum-Version Constraint

Content

View full analysis

=0.23.0 ``` The installation instruction in `SKILL.md` directs users to resolve this unrestricted requirement: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement permits any available `httpx` release at or above version `0.23.0`, including future major versions that were not reviewed with this Skill. No lock file or package hash is supplied. This does not establish that the current `httpx` package is malicious or vulnerable. The security issue is that the installed dependency set is not reproducible and may change after the Skill has been audited. A future compromised release, compromised transitive dependency, or incompatible release could therefore alter runtime behavior without any change to the Skill package itself. Because the scripts import and use `httpx` for authenticated network requests, dependency code runs in the same Python process and receives access to request bodies and authorization headers constructed by the application. ### Attack Path 1. An attacker compromises a future allowed release of `httpx` or one of its resolved dependencies, or a future release introduces a security regression. 2. The malicious or vulnerable version remains compatible with the broad `>=0.23.0` constraint. 3. A user follows the documented command `pip install -r requirements.txt`. 4. Pip resolves and installs that unreviewed version. 5. The Skill imports the dependency and uses it for API requests. 6. Compromised runtime code executes with the privileges of the user running the Skill and may observe phone-number inputs, API responses, and bearer-token-bearing requests. This exploitation path is conditional on a future supply-chain compromise or vulnerable allowed release; no current malicious package was identified during the static ...[truncated 587 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs update/version checks, reads SKILL.md metadata, and writes version-cache files in the user's home directory without describing this behavior in its purpose statement. Undisclosed remote update checks and local persistence can surprise users and introduce privacy or integrity concerns.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill performs update/version checks, reads SKILL.md metadata, and writes version-cache files in the user's home directory without describing this behavior in its purpose statement. Undisclosed remote update checks and local persistence can surprise users and introduce privacy or integrity concerns.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs update/version checks, reads SKILL.md metadata, and writes version-cache files in the user's home directory without describing this behavior in its purpose statement. Undisclosed remote update checks and local persistence can surprise users and introduce privacy or integrity concerns.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs update/version checks, reads SKILL.md metadata, and writes version-cache files in the user's home directory without describing this behavior in its purpose statement. Undisclosed remote update checks and local persistence can surprise users and introduce privacy or integrity concerns.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill explicitly instructs access to a credential file in the user's home directory and manual handling of an API key. Any skill that reads or guides storage of secrets in local files has credential-exposure risk, especially when combined with file and network capabilities.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements account creation, balance lookup, recharge-order creation, and pricing retrieval, which materially exceed the declared phone/WhatsApp validation purpose. In an agent-skill ecosystem, capability mismatch is dangerous because users may invoke a seemingly harmless data-validation skill that also provisions external accounts and payment workflows, increasing the chance of unauthorized billing, data exposure, or hidden platform lock-in.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

Writing a newly issued API key into a .env file in the user's home directory creates a persistent local secret store without any visible permission hardening. If the file is created with overly broad default permissions or later read by other tooling, the API key could be exposed and abused for unauthorized API access or billing-related actions.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for verifying phone numbers and WhatsApp registration status, but this file implements exception telemetry that reports runtime errors to a platform endpoint. That operational behavior is not part of validating phone numbers or cleansing contact data, and represents functionality outside the user-facing scope described in the manifest.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope even though it clearly requires environment-variable access, local file access, and network access. Without a narrow allowlist, an agent runtime may grant broader capabilities than users expect, increasing the chance of unintended file reads/writes or external requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list contains broad phrases such as CRM cleansing and supplier verification, which could cause the skill to be invoked in situations beyond a narrow phone-validation task. Over-broad invocation increases the chance that sensitive workflows or data are routed through this skill unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation describes sending phone numbers and a bearer authorization token, but provides no privacy, storage, masking, retention, or transport-security guidance. Because phone numbers are personal data and bearer tokens grant direct API access, this omission can lead to insecure handling, accidental logging, overexposure in downstream systems, or misuse of sensitive contact data during CRM cleansing and WhatsApp-status checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly permits sending request parameters, response data, and exception context to a platform error-reporting API, which can include phone numbers, WhatsApp status results, CRM data, stack traces, and other sensitive business or personal information. Although it notes that sensitive fields are 'automatically masked,' it does not define masking scope, require minimization, or warn users about third-party transmission, creating a real privacy and data-exposure risk in the context of contact-validation workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

All user-facing natural-language strings in the file, including the module description, CLI help text, errors, and success messages, are exclusively in Chinese. The policy requires avoiding a forced language or locale unless the skill offers user choice or clearly documents a justified locale restriction, which is not present here.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Recharge-order and pricing functions are unrelated to validating phone numbers and WhatsApp status, so their presence expands the attack and abuse surface without clear justification. A user or upstream agent expecting contact verification could be induced into unintended commercial actions such as balance inquiries, pricing calls, or generating payment URLs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This file loads credentials from process environment and from ~/.upkuajing/.env to authenticate outbound API calls. While network access for phone validation is expected, local credential harvesting from user-scoped configuration is a separate capability that is not disclosed in the manifest description or triggers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The request/response logging functions can persist full API parameters and returned data to ~/.upkuajing/logs when logging is enabled. For a phone-validation skill, those payloads may contain phone numbers, WhatsApp status, account metadata, and possibly authentication-adjacent information, creating local sensitive-data exposure without minimization or user warning at the write site.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196