提供海外企业数据、商业数据查询，支持搜索公司与联系人查询服务，帮助用户查找全球企业/海外公司、验证联系人信息、公司邮箱、企业电话、公司职位等，筛选出高质量的 外贸潜在客户 / 外贸线索。助力外贸公司、外贸企业、出口商、采购代理、销售团队发现采购决策者、寻找供应商并加速客户开发 / 获客——所有功能仅需一次搜索即可实现，适用于外贸 B2B找客户、供应商开发与销售线索挖掘。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:20 AM UTC
• Version: 1.0.10

Overview

The skill matches its stated lead-search purpose, but it handles personal contact data, paid account actions, plaintext API keys, and local result storage with insufficient privacy and secret-handling safeguards.

Install only if you are comfortable with a lead-generation tool that sends searches to Upkuajing, retrieves personal contact information, may create paid API activity, stores results locally, and keeps its API key in a plaintext file. Use it only for lawful and authorized outreach or research, avoid displaying or sharing the .env file, review local result files for sensitive data, and confirm paid or diagnostic-report actions carefully.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions even though its instructions clearly require environment-variable access, reading and writing local files, and network/API calls. This mismatch weakens user visibility and policy enforcement, making it easier for a host agent to perform sensitive actions without clear consent boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script forwards an arbitrary `context` field, along with request metadata, to a remote error-reporting endpoint without any minimization, redaction, or schema constraints. In a people/company search skill that likely handles personal and business contact data, error context can easily contain sensitive user inputs, API responses, or identifiers, creating an unjustified secondary data flow beyond the skill’s stated purpose.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs retrieval of personal contact details such as email, phone, and WhatsApp information, and it stores API credentials locally, but it does not include clear privacy, lawful-basis, or sensitive-data handling guidance. In a people-search and lead-generation context, this increases the risk of privacy violations, misuse of personal data, and unsafe handling of credentials.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: 文档明确说明接口可返回员工联系方式、邮箱、电话、WhatsApp 以及“person_contact_show”等个人联系信息，但未给出任何隐私、合规、授权使用或数据最小化警示。结合该技能的业务定位是全球企业/个人信息搜索与客户开发，这会显著增加对个人数据被批量采集、画像、骚扰联系或滥用的风险。

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This API reference explicitly supports searching and filtering people by contactability signals such as phone, email, WhatsApp, website, and social presence, in a product marketed for lead generation and background investigation. In the skill context, that materially increases privacy, profiling, and mass-contact abuse risk because the documentation normalizes access to sensitive personal/contact data without any notice about lawful basis, consent, permitted use, or handling restrictions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The call to `/agent/skill/error/report` transmits request context to the platform, but this file contains no notice, consent mechanism, or even an indication that operational data may be sent off-box for diagnostics. Because this skill processes company and personal information, silent telemetry increases privacy and compliance risk if sensitive data is included in error messages or request context.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script retrieves contact information for companies or individuals through a batch API and then prints the returned data directly, with no user-facing notice, consent check, purpose limitation, or privacy safeguard. In the context of a people/company search tool explicitly marketed for obtaining decision-maker and executive contact details, this increases the risk of privacy abuse, bulk harvesting, spam, and non-compliant processing of personal data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script sends person-search parameters to a remote API and persists returned people data to task result files, but provides no explicit user-facing notice, consent prompt, data-handling disclosure, or safeguards around sensitive personal information. In the context of a tool explicitly designed to discover decision-maker contact details, emails, phone numbers, and WhatsApp data, silent transmission and storage materially increases privacy, compliance, and misuse risk.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The version check transmits the skill identifier to a remote API without any user-facing notice or consent mechanism in this file. Although the data sent is limited, silent network communication can still violate transparency expectations, enable product-usage tracking, and become more sensitive in regulated or tightly controlled environments.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to inspect and handle a local .env file containing an API key and even shows commands that reveal the file contents. That creates a clear risk of credential disclosure to the model, logs, or user-facing output, and normalizes unsafe secret handling in plain language.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 98% confidence
• Finding: The workflow directs the agent to access a local credential store at ~/.upkuajing/.env and potentially create and persist a new API key there. In an agent context, credential discovery and manipulation of local secret files is dangerous because it can expose secrets beyond the minimum necessary scope and create durable credentials without strong user control.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: This line continues the credential-access pattern by directing the agent to determine whether a local API key exists and to save newly issued keys into a plaintext .env file. That is risky because it couples secret enumeration, secret creation, and local persistence in a way that increases the chance of leakage, unauthorized reuse, or exfiltration through downstream tooling or logs.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 80% confidence
• Finding: The script stores and manages an API key in a local .env file under the user's home directory, which can expose credentials if file permissions are too broad, backups are shared, or the file is accidentally checked into source control. In a skill that enables access to sensitive company/person search services and account actions, credential leakage can lead to unauthorized API usage, account balance abuse, and data access.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 78% confidence
• Finding: Reading an API key from a plaintext .env file reinforces insecure secret handling and increases the chance that long-lived credentials are exposed through local compromise, shared environments, or developer mistakes. Because this skill accesses account and search APIs, compromise of that file could enable unauthorized queries and billing operations.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 87% confidence
• Finding: Writing the newly issued API key directly into a plaintext .env file creates a credential-at-rest exposure. If that file is world-readable, synced to cloud storage, or copied into logs or repos, an attacker can reuse the key to access the associated backend services and potentially consume paid account balance.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 89% confidence
• Finding: The dependency is specified with only a lower bound, which allows future major or minor versions of httpx to be installed without review. This can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerable versions into the skill at install time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197