联系方式有效性校验，验证电话号码有效、无效、座机、手机、是否注册WhatsApp多种状态，验证邮箱地址有效和无效，支持网站域名有效、无效。帮助销售团队、招聘人员、贸易商验证联系数据（邮箱验证、手机号验证、域名校验）、减少退信邮件、提升外联与冷启动效率——是 CRM 数据清洗、候选人筛查、供应商核验、邮件列表清洗的必备工具，适用于外贸邮件群发前清洗、招聘背调与采购商核实。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:15 AM UTC
• Version: 1.0.4

Overview

This is a paid contact-validation skill that sends phones, emails, and domains to Upkuajing's API and uses a local API key, with disclosed but important privacy, billing, and credential-storage caveats.

Install only if you are comfortable sending the contact records you check to Upkuajing's API, paying for validation calls, and storing the API key in ~/.upkuajing/.env. Review payment URLs before opening them, avoid putting secrets or full customer payloads in error reports, and consider tightening local file permissions on the API key file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading environment variables, reading and writing files under ~/.upkuajing/.env, and making network requests to external APIs. This creates a transparency and consent gap: users may invoke a seemingly simple validation skill without understanding it can access credentials, persist data locally, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a contact-validity checker, but it also documents account provisioning, recharge order creation, pricing queries, exception reporting, remote version checks, and domain validation. This mismatch increases the risk of users consenting to one narrow purpose while the skill performs broader account, billing, and telemetry-related actions they did not reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation frames the skill as contact validity checking, but it also instructs the agent to perform account and operational actions such as API key application, recharge handling, and exception reporting. These are materially different capabilities that expand the trust boundary and may expose users to unintended credential management, billing, or data-sharing actions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Creating recharge orders and directing users to payment URLs is outside the core purpose of contact validation and introduces billing and transaction-handling behavior. If misused or triggered unexpectedly, it could lead users into unanticipated payment flows or social-engineering-like interactions under the guise of a validation tool.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatically applying for a new API key and saving it into ~/.upkuajing/.env gives the skill credential-management capability beyond its stated purpose. Credential creation and local persistence are sensitive operations because they can alter a user's environment, create long-lived secrets, and expand the blast radius if the host or skill is later compromised.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key provisioning, account lookup, and recharge/payment operations, which are materially unrelated to the advertised skill purpose of validating contact information. This expands the skill's privilege and financial/account-management surface, creating unnecessary risk of secret issuance, account misuse, and billing abuse if the skill is invoked unexpectedly or repurposed.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: This code sends request metadata and free-form context to a platform error-reporting endpoint, despite the skill being described as a contact-validity checker rather than a telemetry tool. If `context` or request metadata contains customer data, contact details, or other sensitive operational information, failures could trigger unintended exfiltration of data to the platform beyond the user’s expected purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: 该模块实现了与“联系方式有效性核验”核心功能无关的远程版本探测、升级提示和本地持久化缓存逻辑，属于超出技能声明范围的额外能力。此类隐藏式附加能力会在技能运行时主动联系外部服务并记录状态，增加隐私暴露、行为不可预期和供应链风险。

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: 代码会在用户主目录下创建 .upkuajing 目录并写入 version_cache.json，这属于与技能业务目标无直接关系的本地持久化行为。未经明确说明的文件系统写入会扩大权限使用面，可能泄露使用痕迹、破坏最小权限原则，并在受限环境中带来合规与安全问题。

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: 该技能包含与联系方式核验无直接关系的网络版本探测能力，会在运行过程中向远程 API 发送技能名称并接收响应。额外的出站网络面增加了隐私泄露、遥测追踪、网络依赖和潜在供应链滥用的风险，尤其是在用户未预期该技能会联网探测版本时。

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation describes sending phone numbers along with an Authorization bearer token to an external API, but it provides no warning about privacy, data handling, or secret exposure. In a contact-validation skill, this omission can cause users or downstream agents to transmit personal data and credentials without informed consent or proper safeguards, increasing the risk of privacy violations and token leakage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly instructs callers to upload `requestParams`, `responseData`, and `context` to an error-reporting endpoint, and those fields can contain sensitive operational or personal data. Although it mentions that sensitive fields will be auto-masked, it does not define the masking scope, does not warn users to avoid including secrets/PII in stack traces or payloads, and therefore creates a realistic risk of unintended data exfiltration to the platform.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request/response logging helpers can persist API inputs and outputs to local log files under the user's home directory. For a contact-validation skill, those payloads may contain emails, phone numbers, and other sensitive business or personal data, creating an unnecessary local data exposure risk if logging is enabled.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The script sends user-supplied domain data to a remote API without an explicit disclosure in the CLI interface that inputs will be transmitted off-host. While domains are typically less sensitive than credentials or personal identifiers, undisclosed network transmission can still expose internal, customer, or proprietary target lists and may violate user expectations or organizational data-handling policies.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends user-supplied email addresses to a remote API endpoint for validation, but it provides no explicit notice, consent step, or clear disclosure at runtime that sensitive contact data will leave the local environment. In a CRM/data-cleaning context, these addresses may belong to customers or leads, so silent transmission creates privacy, compliance, and data-handling risk even if the API is legitimate.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The network call transmits `requestId`, `requestPath`, and `context` without any user-facing warning or consent flow. In this skill context, error context may plausibly include customer contact information or validation results, so silent transmission increases privacy and data-handling risk even if the destination is the platform operator.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends phone numbers to an external endpoint via make_request('/agent/validation/phone', params) without any user-facing disclosure, consent step, or privacy warning at the point of collection. Because phone numbers are personal data, silent transmission to a third-party service can create privacy, compliance, and data-handling risks, especially in CRM or lead-enrichment workflows processing bulk contact lists.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: 自动网络版本检查会在无用户提示或同意的情况下发送技能元数据（如 skill_name）到外部服务。这种静默遥测行为违背最小披露原则，可能暴露用户安装或使用了哪些技能，并为服务端建立使用画像提供条件。

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs checking for and using a secret stored in ~/.upkuajing/.env, which is credential access behavior. Accessing local secret files is dangerous because it exposes sensitive API keys to the skill runtime and can normalize broader secret-file inspection in a tool that users may believe only validates contact data.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: The documented ability to request a new API key and automatically save it to ~/.upkuajing/.env combines credential generation with local secret persistence. This is sensitive because it writes long-lived authentication material to disk, potentially without sufficient separation from the validation workflow, increasing the chance of secret leakage or unauthorized reuse.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 78% confidence
• Finding: The script writes a newly issued API key in plaintext to a .env file under the user's home/application directory. Plaintext secret storage can lead to credential compromise through weak filesystem permissions, backups, multi-user access, or accidental inclusion in logs or support artifacts; in this skill context, the secret also unlocks account and billing-related actions unrelated to contact validation.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 74% confidence
• Finding: On failure paths, the script returns the exact env file path and instructs manual environment-variable setup for the API key, reinforcing insecure secret handling practices. While the path disclosure is minor, the bigger issue is operationalizing manual/plaintext credential placement that increases the chance of accidental leakage or mishandling.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower bound only (httpx>=0.23.0), which allows installation of any newer release, including versions with breaking changes or newly introduced supply-chain risk. While this is not an immediate exploit by itself, it weakens build reproducibility and can cause the skill to pull in an unexpected or vulnerable package version over time.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: The explicit require_auth=False parameter disables client-side authentication for the API-key-creation request, making key issuance available as an unauthenticated operation from this script. In a skill that should only validate contact info, exposing unauthenticated auth/billing bootstrap logic is especially risky because it broadens the attack surface beyond the declared purpose.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: The explicit require_auth=False parameter disables client-side authentication for the API-key-creation request, making key issuance available as an unauthenticated operation from this script. In a skill that should only validate contact info, exposing unauthenticated auth/billing bootstrap logic is especially risky because it broadens the attack surface beyond the declared purpose.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196