Full contact data validation eliminates inaccurate lead information for global B2B prospecting. Run multi-dimensional phone checks to distinguish valid/invalidnumbers, landlines, mobile lines and WhatsApp registered accounts. Complete email authentication to flag active and dormant mailboxes, alongside domainvalidation to confirm functional or defunct business websites. Streamline email validation, phone validation and domain verification workflows for sales teams,recruiters and export businesses. Cut email bounce rates drastically and boost efficiency for B2B cold outreach and global prospect search. Execute professionalCRM data cleansing, candidate screening and supplier lead validation via all-in-one verification features. Perfect for bulk export email pre-sending datacleaning, talent recruitment screening and overseas buyer identity verification.

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.4

Overview

The skill is a disclosed paid contact-validation API wrapper, with some security hygiene issues users should understand before installing.

Install only if you are comfortable sending phone numbers, emails, and domains to UpKuaJing for paid validation. Protect ~/.upkuajing/.env as a secret file, review charges before confirming paid calls or top-ups, and avoid including unnecessary personal or customer data in optional error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:60

Finding

API Key Stored Without Explicitly Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Dependency Version Prevents Reproducible Installation

Content

View full analysis

=0.23.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement allows any `httpx` version from 0.23.0 onward, including future major or otherwise unreviewed releases. Transitive dependencies are likewise not locked or hash-verified. `httpx` is a legitimate dependency and no typosquatting, dependency confusion, malicious package source, or known malicious version was identified in the reviewed project. The weakness is that installation is not reproducible and may resolve to code that was unavailable when the Skill was audited. Because Python packages and their dependencies execute with the installing user's privileges, a compromised future release or dependency could affect installation or runtime behavior. An incompatible future release could also change TLS, proxy, redirect, or request semantics. ### Attack Path 1. A user follows the Skill documentation and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest release satisfying `httpx>=0.23.0`, along with currently resolved transitive dependencies. 3. If a selected future release or transitive dependency is compromised, its installation or imported runtime code executes with the user's privileges. 4. That code could access files, environment variables, or network resources available to the Python process, including `UPKUAJING_API_KEY`. This path depends on a future upstream or package-index compromise; no current malicious dependency was established by the static audit. ### Impact Assessment The theoretical impact is bounded by the privileges of the user performing installation or running the Skill. A compromised dependency could read credentials, alter API requests, exfiltrate contact data, or execute arbitrary co ...[truncated 145 chars]

Remediation

View remediation

other

Note

• Location: scripts/version_check.py:91

Finding

Automatic Version Check Discloses Skill Metadata and Writes Persistent State Without Documentation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs remote version checks, local cache writes, and SKILL.md parsing beyond the advertised validation task, that expands its behavioral scope and creates additional network and filesystem touchpoints not clearly disclosed to users. Hidden update or telemetry mechanisms can be abused or simply violate least-surprise expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill performs remote version checks, local cache writes, and SKILL.md parsing beyond the advertised validation task, that expands its behavioral scope and creates additional network and filesystem touchpoints not clearly disclosed to users. Hidden update or telemetry mechanisms can be abused or simply violate least-surprise expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill performs remote version checks, local cache writes, and SKILL.md parsing beyond the advertised validation task, that expands its behavioral scope and creates additional network and filesystem touchpoints not clearly disclosed to users. Hidden update or telemetry mechanisms can be abused or simply violate least-surprise expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs remote version checks, local cache writes, and SKILL.md parsing beyond the advertised validation task, that expands its behavioral scope and creates additional network and filesystem touchpoints not clearly disclosed to users. Hidden update or telemetry mechanisms can be abused or simply violate least-surprise expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs remote version checks, local cache writes, and SKILL.md parsing beyond the advertised validation task, that expands its behavioral scope and creates additional network and filesystem touchpoints not clearly disclosed to users. Hidden update or telemetry mechanisms can be abused or simply violate least-surprise expectations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill instructs checking and manually populating ~/.upkuajing/.env with an API key, which involves local credential discovery and storage. Any skill that reads or writes credential files increases the risk of secret exposure, accidental overwrite, insecure file permissions, or exfiltration if paired with network capabilities.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [UpKuaJing Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

Writing a newly issued API key into a plaintext .env file under the user's home directory creates a local secret-storage weakness. If filesystem permissions are too broad, backups are exposed, or other local processes can read the file, the key can be stolen and abused to access the associated account or API usage.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 67% confidence

Finding

The failure path instructs the user to manually set the API key as an environment variable, which is not inherently unsafe, but together with plaintext-file storage reflects weak secret-handling practices and increases the chance of exposure through shell history, process listings, or misconfigured environments. This is a security hygiene issue rather than direct credential exfiltration.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating recharge orders is a payment-related capability unrelated to validating contact information, and exposing it through this skill can trigger financial workflows users do not expect. In a skill advertised for data cleansing, hidden or loosely justified payment actions are especially risky because they can be abused to initiate unauthorized billing steps or social-engineer users into completing payments.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope even though its documented behavior requires environment access, filesystem reads/writes, and network/API calls. That creates an overbroad, under-specified trust boundary: users and hosting platforms cannot easily constrain what the skill may access, increasing the chance of unintended credential, file, or network exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description embeds activation phrases such as "email validation," "domain verification," and especially "CRM data cleansing," which are broad capability descriptions rather than narrowly scoped invocation triggers. The file does not provide exclusion conditions or negative examples, so these phrases could cause unintended invocation for ordinary requests about general data cleanup or verification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Including top-up order creation and payment guidance inside a contact-validation skill introduces billing functionality outside the core purpose. This increases phishing-like risk and the chance that users are steered into financial actions from a workflow they expected to be purely technical validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all user-facing documentation exclusively in Chinese, and it does not indicate that the skill is region-specific or provide any opt-in or alternative language. Under the policy, forcing a specific language without user choice or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document instructs agents to report exceptions by sending request parameters, response data, and error context to a remote API. Even though it mentions automatic masking of sensitive fields, it does not define what is masked, does not require minimization, and does not warn operators that contact data, tokens, stack traces, or user-provided content could be transmitted off-path during failures. In a contact-validation skill, failed requests may contain emails, phone numbers, WhatsApp-related data, and CRM records, making unintended disclosure more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file implements account provisioning, account information lookup, recharge-order creation, and pricing queries, which materially exceed the declared contact-validation behavior of the skill. Such scope expansion increases the attack surface and can enable unintended account or billing interactions through a skill that users would not reasonably expect to manage platform authentication and payments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module title, descriptions, and all user-facing CLI help/messages are written only in Chinese, which imposes a specific language on users. The file does not offer a language choice or explain that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Account balance and pricing retrieval expose business-account information beyond the core validation use case and can leak operational or financial metadata. While not as severe as direct payment initiation, these capabilities expand access to sensitive account details and normalize account-management behavior in a skill whose stated purpose is contact verification.

Content

No source excerpt is available for this finding.