ClawHub
Back to skill

Security audit

联系方式有效性校验，验证电话号码有效、无效、座机、手机、是否注册WhatsApp多种状态，验证邮箱地址有效和无效，支持网站域名有效、无效。帮助销售团队、招聘人员、贸易商验证联系数据（邮箱验证、手机号验证、域名校验）、减少退信邮件、提升外联与冷启动效率——是 CRM 数据清洗、候选人筛查、供应商核验、邮件列表清洗的必备工具，适用于外贸邮件群发前清洗、招聘背调与采购商核实。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its contact-validation purpose, but it handles API credentials and billing-related actions in ways users should review carefully before installing.

Install only if you trust Upkuajing with the contact data you submit and with a paid API key on this machine. Do not let the agent print the `.env` file contents; configure the key through a protected secret mechanism if possible, restrict permissions on `~/.upkuajing/.env`, and require explicit confirmation before any paid validation, error report, account query, or recharge-order action.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:79
Finding

API Key Disclosure Through Credential File Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-82
Vulnerability Type: Credential exposure through terminal output
Risk Level: Medium

Vulnerable Code Snippet:

bash
cat ~/.upkuajing/.env

Technical Analysis

The Skill instructs the Agent to print the complete contents of the credential file. This file contains UPKUAJING_API_KEY, so executing the command exposes the plaintext secret through standard output.

Printing the credential is not necessary to determine whether it is configured. Terminal output may be retained in Agent conversation history, command logs, telemetry, debugging records, or other captured execution output. This behavior therefore expands access to the secret beyond the minimum privilege required for authenticated API calls.

Attack Path

  1. The Agent loads the Skill instructions and needs to verify API-key configuration.
  2. The Agent follows the documented command and executes cat ~/.upkuajing/.env.
  3. The complete API key is emitted to terminal output.
  4. The output is captured in an Agent transcript, execution log, telemetry system, or shared terminal.
  5. A party with access to that output obtains the API key.
  6. The exposed key is used to make authenticated or paid requests under the victim's account.

Impact Assessment

Successful exploitation discloses the vendor API credential. An attacker could access functionality authorized by that key, consume the account balance through paid requests, retrieve available account information, or create unwanted recharge-related operations. The issue does not directly grant operating-system privileges, but it compromises the external service account associated with the key.

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to print the credential file.
  • Use a non-disclosing test that reports only whether a non-empty key exists.
  • Never include the key value in terminal output, Agent responses, exceptions, or logs.
  • Update the Skill instructions to explicitly prohibit displaying the API key.
  • If a key may already have appeared in captured output, revoke and rotate it.
  • Prefer passing the key through a protected environment variable or operating-system secret store rather than inspecting a plaintext file interactively.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:68
Finding

API Key File Is Created Without Enforced Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 68-73
Vulnerability Type: Insecure local secret storage permissions
Risk Level: Medium

Vulnerable Code Snippet:

python
UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)

with open(env_file, 'w', encoding='utf-8') as f:
    f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The newly issued API key is stored in plaintext, but the code does not explicitly enforce owner-only permissions on either ~/.upkuajing or its .env file. The resulting permissions depend on the process umask and any pre-existing directory or file permissions.

In an environment with a permissive umask, the credential file may be readable by other local users. Opening an existing path with ordinary write mode also does not protect against unsafe pre-existing file types such as symbolic links. Secure credential persistence should not rely solely on ambient process configuration.

Attack Path

  1. A user invokes the new-key operation.
  2. The vendor returns a new API key.
  3. The script creates or overwrites ~/.upkuajing/.env using default permissions derived from the current umask.
  4. Under a permissive configuration, another local user or process can read the file.
  5. Alternatively, an attacker who can prepare the destination path may attempt to abuse an unsafe pre-existing link.
  6. The attacker obtains the key and uses it for authenticated vendor API requests.

Impact Assessment

The issue may expose the external service credential to other users or processes on the same host. A stolen key could be used to consume paid API services, access account information exposed by the authenticated endpoints, and act under the associated vendor account. The weakness does not independently provide elevated operating-system privileges, and exploitation requires relevant local access or unsafe filesystem permissions.

Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with owner-only mode 0700.
  • Create the credential file atomically with mode 0600, rather than relying on the process umask.
  • Correct permissions on existing directories and credential files before using them.
  • Where supported, reject symbolic links and use no-follow semantics when opening the file.
  • Write through a securely created temporary file in the same directory, set its permissions, flush it, and atomically replace the destination.
  • Consider using an operating-system credential manager instead of a plaintext environment file.
  • Avoid returning any portion of the existing key in status messages, even if currently truncated.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Dependency Version Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code Snippet:

text
httpx>=0.23.0

Technical Analysis

The dependency specification establishes only a minimum version and permits installation of any later httpx release. It also provides no cryptographic hashes or lock file. Consequently, dependency resolution can select code that was not reviewed with this Skill and can change without any modification to the project.

This is a supply-chain hardening weakness rather than evidence that the current dependency is malicious. Exploitation would require compromise of the package distribution path, a malicious or otherwise unsafe future release, or an incompatible update that changes runtime behavior.

Attack Path

  1. A user follows the documented installation procedure.
  2. The package resolver selects the newest release satisfying the lower-bound constraint.
  3. That release has not necessarily been reviewed against this Skill.
  4. If the selected package or distribution channel is compromised, malicious code can execute during installation or import.
  5. Such code inherits the privileges of the user running the Skill and may access the API key and submitted contact data.

Impact Assessment

A compromised dependency could execute with the installing user's privileges, read locally accessible data, intercept the API key, alter HTTPS request behavior, or exfiltrate validation inputs. The practical likelihood is limited because the package name is legitimate and no current malicious package was identified, but the absence of pinning and hashes weakens reproducibility and supply-chain integrity.

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to an exact reviewed version.
  • Generate and commit a lock file containing hashes for the dependency and its transitive dependencies.
  • Install with hash verification enabled.
  • Review and deliberately update dependency versions through a controlled upgrade process.
  • Use automated vulnerability monitoring for pinned packages.
  • Rebuild the lock file only from trusted package indexes and controlled build environments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes an exception-reporting workflow that transmits request identifiers, request paths, and contextual runtime data to a platform endpoint, but this operational telemetry is outside the advertised contact-validation purpose. Hidden or under-disclosed telemetry increases privacy risk and can leak sensitive metadata about user activity or failed requests.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill instructs the agent to read a local environment file containing an API key, which is credential material. Encouraging direct file access to secrets expands the credential exposure surface and can lead to accidental disclosure, misuse, or propagation of the key beyond the minimum necessary runtime context.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill allows applying for a new API key and automatically saving it into a local .env file. Automated credential issuance and persistence can create unmanaged secrets, make later exfiltration easier, and blur the boundary between validating contacts and provisioning long-lived access credentials.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The instruction to check for and populate UPKUAJING_API_KEY in ~/.upkuajing/.env normalizes direct handling of plaintext credentials in the filesystem. In the context of an agent skill with network and file capabilities, this is particularly dangerous because it combines secret discovery, storage, and later use in one workflow.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

该脚本不仅做“联系方式有效性核验”，还实现了 API 密钥申请、账户查询、余额查看、充值下单和价格查询等账户管理能力，明显超出技能声明范围。超范围能力会扩大攻击面，使调用方在以为只是数据核验时，实际上授予了账户与计费相关操作入口。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

代码显式围绕 .env 中的 API 密钥进行读取/管理，说明技能承担了凭据处理职责。将高价值凭据保存在普通文本配置文件中，若文件权限、日志、备份或工作区共享配置不当，容易造成凭据泄露。

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

此处读取现有 .env 文件并解析 API 密钥，进一步确认该技能可访问本地凭据材料。具备读取本地 secrets 的业务技能若被误用、复用或扩展，可能成为凭据枚举和泄露链条的一部分。

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

代码会把新申请的 API 密钥直接写入 .env 文件进行明文持久化。明文落盘会显著增加被本地用户、恶意进程、同步/备份工具或误提交到版本库时泄露的风险，一旦泄露可导致账户被他人调用和计费滥用。

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

错误信息会返回 env 文件路径并提示手动设置环境变量，虽然没有直接泄露密钥值，但会暴露凭据存储位置和配置方式。对攻击者而言，这类路径与配置细节可降低后续搜寻和窃取凭据的难度。

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

创建充值订单属于资金与账户操作，与“联系方式有效性核验”无直接必要关系。若该能力被意外暴露给代理或工作流，可能触发未预期的付费流程、诱导用户跳转支付，甚至被用作计费滥用通道。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring and CLI description explicitly state that this script checks domain validity and security, and the code sends domains to '/agent/validation/domain'. The manifest describes a skill for validating contact information such as email addresses and phone numbers before outreach; standalone domain security/validity analysis is a different capability not clearly covered by that scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

技能清单声明该技能用于核验邮箱、手机号及其他联系方式的真实有效性，但此文件的核心行为是收集参数并调用 /agent/skill/error/report 接口上报异常。异常上报并不是联系方式核验的直接实现细节，而是与声明用途明显不同的运行能力。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior includes reading environment files, writing API keys to disk, and making remote network requests. This weakens least-privilege controls and increases the chance that an agent executes broader capabilities than users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing instructions in this file are in Chinese, and the skill name suffix also indicates a Chinese-localized variant, but the document does not explicitly state that the skill is region- or language-specific or provide user opt-in for language choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill does not clearly warn users that submitted phone numbers, email addresses, and domains will be sent to an external API service for validation. Because these data points can be personal or commercially sensitive, lack of disclosure undermines informed consent and may violate privacy expectations or policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196