Run enterprise bulk cold email marketing campaigns with full lifecycle email tracking covering sent, delivered, opened, read and replied statuses. Accessverified domain business emails to help exporters, sourcing agents and sales teams connect with purchasing decision-makers worldwide. Launch streamlined massemail campaigns and analyze open rate and click-through rate performance metrics for B2B lead generation. Powerful bulk mailing tools streamline overseas leadgeneration, global business expansion and export client acquisition workflows. Built exclusively for B2B cold outreach, cross-border e-commerce email marketingand global sales prospecting.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:13 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed UpKuaJing email-sending integration, but users should treat it as sensitive because it can send paid emails and uses a local API key.

Install only if you intend to use UpKuaJing for paid email operations. Keep the API key private, review recipient lists and costs before sending, avoid putting secrets or customer data in error reports, and be aware that the advertised lead-finding language is not implemented by these scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions while its documented behavior clearly requires access to environment variables, local files, and outbound network calls. This creates a transparency and consent problem: an orchestrator or user may invoke the skill without understanding that it can read credentials from disk and contact remote services. In a security-sensitive agent ecosystem, hidden capabilities materially increase risk even if the capability is part of the intended workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill advertises broad email prospecting, verified domain-based contacts, and open/click analytics, but the documented functionality includes additional account-management and payment-related actions while omitting some claimed features. This mismatch can mislead users and agent planners into invoking the skill under false assumptions, including for credential setup, balance operations, and reporting flows that have different privacy and financial implications. Security-wise, deceptive or inaccurate capability descriptions reduce informed consent and make misuse harder to detect.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The file implements API key issuance, account lookup, and recharge/payment functionality that is broader than the advertised cold-email campaign purpose. This kind of scope expansion increases trust and abuse risk because users may invoke billing or account-management operations they did not expect from an email-marketing skill.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: Creating recharge/payment orders is a financial capability that is not clearly justified by the stated email marketing workflow. Hidden or weakly disclosed payment flows can enable unexpected charges, phishing-style redirection to payment URLs, or misuse of a trusted agent context for financial actions.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are broad enough to match common business-email or lead-generation requests, which can cause the skill to activate in contexts where the user did not specifically intend to use this third-party service. Because the skill can incur charges and handle credentials, overbroad routing increases the chance of unintended invocation, data transfer, or fee-generating actions. The surrounding mass-email context makes accidental activation more concerning than for a harmless read-only utility.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API documentation explicitly encourages sending request parameters, response data, and exception context for error reporting, but it does not clearly warn that these fields can contain sensitive information such as API inputs, business data, tokens, customer identifiers, or stack traces. Although it mentions automatic masking of sensitive fields, that claim is undefined and incomplete, so users may over-trust the platform and transmit data that should not leave their environment.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This code sends user-supplied parameters to a remote third-party API and includes optional request/response logging that can persist potentially sensitive business data, API results, or personal contact information to local disk. In the context of a bulk cold-email and lead-generation tool, those payloads may contain prospect identifiers, campaign data, and email-related metadata, so enabling logging without redaction or explicit consent increases privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function sends request metadata and free-form context to a remote endpoint without any visible minimization, consent, redaction, or warning. If callers include sensitive details in `context`, `requestPath`, or `requestId`, the module can leak internal workflow data, customer content, or identifiers to the platform, which is more concerning in an email-marketing skill that may process lead and campaign information.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [UpKuaJing Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

• Confidence: 90% confidence
• Finding: The skill instructs reading and modifying a local credential file containing an API key. Accessing secrets in ~/.upkuajing/.env and asking users to manually place credentials there creates a clear credential-handling surface; if the skill or surrounding agent runtime is compromised or over-privileged, those secrets could be exposed or reused for unauthorized account activity. This is especially sensitive because the same key can be used for billable actions and account information retrieval.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 91% confidence
• Finding: The code writes a newly issued API key to a plaintext .env file in the user's home directory. Storing long-lived API credentials unencrypted in a predictable location increases the risk of local compromise, accidental inclusion in backups or version control, and theft by other processes or users on the same system.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 80% confidence
• Finding: The error path encourages manual setting of the API key environment variable and returns the env file path, reinforcing ad hoc secret handling without guardrails. While not exfiltration, this can lead to insecure operator behavior such as shell history leakage, weak storage practices, or exposing sensitive paths in logs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only (httpx>=0.23.0), which allows installation of any future major or minor release. This can introduce vulnerable, compromised, or breaking versions through the supply chain and makes builds non-reproducible. In a bulk cold-email tool that likely performs network requests and handles campaign telemetry, an unexpected httpx version could directly affect outbound communications or expose data handling paths.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_send.py:31

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_task_list.py:29

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_task_record_list.py:30

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:121