支持批量群发企业营销邮件，支持追踪每一封邮件的发送、到达、打开、已阅、回复多种状态；提供企业域名邮箱，帮助外贸公司、外贸企业、出口商、采购代理、销售团队触达决策者、轻松邮件群发，并分析邮件打开率与点击率。在外贸获客、企业出海、海外获客中提供强大的批量营销能力，适用于外贸开发信、跨境电商邮件营销与销售获客。

• Outcome: Review
• Latest audit: Jul 16, 2026 · 7:22 AM UTC
• Version: 1.0.2

Overview

This is a coherent email-sending API skill, but it uses a third-party service, paid actions, and local API-key storage that users should understand before installing.

Install only if you intend to use UpKuajing's external email platform and are comfortable sending recipient lists, message content, and tracking data to that service. Confirm costs before sending mail or creating recharge orders, protect ~/.upkuajing/.env as a secret file, and avoid sharing command output that contains API keys.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares runtime requirements and documents behavior that reads environment variables, reads and writes local files under the user's home directory, and makes network/API calls, but it does not declare corresponding permissions. This creates a transparency and consent gap: users and the platform may underestimate what the skill can access or modify, especially around API keys and persisted state.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation says the skill consists of three scripts for mail send and task queries, but later instructs the agent to invoke an additional undeclared auth.py for key issuance, recharge order creation, account info, and price lookup. Hidden or undocumented execution paths increase the attack surface and can lead to unexpected credential, billing, or account-affecting actions outside the advertised scope.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key issuance, account balance lookup, and payment/order creation, which materially exceed the stated purpose of an email sending and tracking skill. In an agent-skill setting, undeclared financial and credential-management capabilities increase the attack surface and can enable unanticipated account or billing actions by the host agent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Creating recharge orders and returning payment URLs is a financial capability unrelated to the declared email marketing purpose. Even without direct payment execution in this file, exposing billing initiation from an unexpected tool can mislead users or allow abusive workflow chaining in an agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code can request a fresh API key and persist it locally, which is a privileged credential lifecycle function beyond the stated business purpose of email sending/tracking. In skill ecosystems, undisclosed credential provisioning increases the risk of unauthorized onboarding, secret sprawl, and misuse of downstream APIs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document describes sending emails and tracking opens, clicks, and replies, but it does not warn users that recipient addresses, message content, and engagement metadata are transmitted to and processed by an external service. In a cross-border marketing context, this can lead to unintended disclosure of personal data and compliance risks because users may supply customer information without understanding the third-party handling and tracking involved.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends recipient email addresses and full message content to an external API endpoint without any explicit user-facing notice or confirmation at the point of execution. In a tool that handles outbound communications and potentially sensitive business or personal data, this can cause unintentional disclosure if users assume the action is local or do not realize data is transmitted to a third-party service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code automatically sends the skill name to a remote endpoint for version checking without any visible user consent or disclosure in this module. Although the transmitted field is limited, it still reveals installed-skill usage metadata and creates an unexpected outbound network call, which is a privacy and transparency issue and can matter in restricted or monitored enterprise environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 93% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_send.py:31

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_task_list.py:29

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_task_record_list.py:30