It validates phone-number status including valid, invalid, landline, mobile andWhatsApp-registered statuses. It helps sales teams, recruiters, traders and exportersverify phone-number authenticity, cut invalid contacts and boost outreach efficiency. Thisessential tool supports CRM data cleansing, candidate screening and supplier verification.It works for pre-send cleanup for bulk foreign-trade SMS, recruitment background checksand buyer validation.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:59 AM UTC
• Version: 1.0.2

Overview

This is a paid remote phone-validation skill with disclosed API-key, fee, top-up, and optional error-report flows; I found no deceptive, destructive, or unrelated data-exfiltration behavior.

Install only if you are comfortable sending phone numbers to the Upkuajing/Open Platform API and paying per validation. Keep the API key private, consider protecting ~/.upkuajing/.env with owner-only file permissions, avoid enabling API logging unless needed, and review any top-up payment URL or error-report context before proceeding.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates capabilities to access environment variables, read and write local files under the user's home directory, and make network requests, yet no explicit permission model is declared. This creates a transparency and consent problem: users may invoke a seemingly simple phone-validation skill without being clearly told it can persist credentials locally and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is phone/WhatsApp validity checking, but the skill also includes credential setup, local credential storage, balance and pricing retrieval, top-up/payment flow initiation, and remote error reporting. This broader behavior increases attack surface and user surprise, and could be abused for unintended outbound actions or collection of operational/account metadata beyond the core validation task.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements API key issuance, account lookup, recharge-order creation, and pricing queries, which are materially broader than the advertised phone-validation and WhatsApp-checking purpose. That scope mismatch is dangerous because it introduces credential lifecycle and billing capabilities into a skill that users would not reasonably expect to modify accounts or create payment-related actions, increasing the blast radius if the skill is misused or triggered unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The recharge-order and account-management functions are not justified by the skill's stated purpose and enable financial/account actions from within a data-validation workflow. Even if legitimate for the vendor's platform, embedding these operations here creates unnecessary attack surface and raises the risk of unauthorized billing or account reconnaissance through an unexpectedly privileged skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module makes an outbound HTTP request to a remote API for version checking, which is unrelated to the skill’s declared phone/WhatsApp validation purpose. Even if intended for update notification, this creates undeclared network egress, can disclose skill usage metadata, and expands the trust boundary to a remote service without clear user consent or documentation.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The code persists cache data under the user’s home directory, which exceeds a validation-only skill’s stated behavior and leaves local artifacts without clear disclosure. While the cached content is limited to version-check metadata, persistent filesystem writes can violate least surprise, create privacy concerns, and complicate sandboxing or multi-tenant environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation describes sending phone numbers under bearer-token authentication but provides no privacy, handling, or transmission warning for sensitive personal data. In a skill explicitly meant for bulk validation, this omission can lead users to send third-party phone numbers to an external service without considering consent, lawful basis, retention, or secure token handling, increasing privacy and credential-exposure risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The helper sends arbitrary params to a third-party API endpoint and can optionally log full request and response bodies locally. In a phone/WhatsApp validation skill, those params are likely to contain phone numbers and related contact data, so transmitting and potentially storing them without clear disclosure or minimization creates privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script forwards a caller-supplied `context` field, along with request metadata, to a remote `/agent/skill/error/report` endpoint without any sanitization, minimization, or disclosure in this file. Error context often contains stack traces, request content, identifiers, or user data, so transmitting it verbatim can leak sensitive operational or customer information to an external service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script transmits phone numbers to an external API endpoint for validation, but it gives users no explicit notice that personal contact data will leave the local environment. Phone numbers are personal data in many jurisdictions, and silent transmission can create privacy, compliance, and consent risks, especially when used for CRM cleansing or bulk verification workflows.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

• Confidence: 84% confidence
• Finding: The skill instructs checking for and using an API key stored in ~/.upkuajing/.env, which is credential handling and local secret access. Even though this appears intended for normal authentication, reading and guiding persistence of secrets in a local file increases the risk of accidental exposure, misuse by adjacent functionality, or overbroad access by the skill runtime.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 86% confidence
• Finding: The code writes a newly issued API key to a plaintext .env file under the user's home configuration directory without any visible permission hardening or secure storage controls. Plaintext secret storage increases the chance of local disclosure through other processes, backups, accidental commits, or overly permissive filesystem settings.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 84% confidence
• Finding: On write failure, the code instructs the user to set the API key manually as an environment variable, which can lead to insecure handling through shell history, process inspection, screenshots, or misconfigured CI/runtime environments. While not directly exploitable in code, this encourages risky secret-management practices around a sensitive credential.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including future releases that may introduce breaking changes or vulnerable transitive dependency combinations. While this is a supply-chain hygiene issue rather than an immediately exploitable flaw by itself, it weakens build reproducibility and can unexpectedly pull in unsafe versions over time.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False for an authentication-management endpoint establishes an unsafe default for a credential-sensitive action. In the context of a phone-validation skill, this is more concerning because users would not expect the tool to expose unauthenticated credential provisioning behavior at all, making privilege boundaries less clear and abuse more likely.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False for an authentication-management endpoint establishes an unsafe default for a credential-sensitive action. In the context of a phone-validation skill, this is more concerning because users would not expect the tool to expose unauthenticated credential provisioning behavior at all, making privilege boundaries less clear and abuse more likely.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196