Security audit

提供海外企业数据、商业数据查询，支持搜索公司与联系人查询服务，帮助用户查找全球企业/海外公司、验证联系人信息、公司邮箱、企业电话、公司职位等，筛选出高质量的外贸潜在客户 / 外贸线索。助力外贸公司、外贸企业、出口商、采购代理、销售团队发现采购决策者、寻找供应商并加速客户开发 / 获客——所有功能仅需一次搜索即可实现，适用于外贸 B2B找客户、供应商开发与销售线索挖掘。

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real paid company-and-people search skill, but it needs Review because it handles API keys and personal contact data with weak local storage and disclosure safeguards.

Before installing, assume your searches and retrieved contact records are sent to and processed by Upkuajing, may incur charges, and may be saved locally. Do not print the .env file, restrict permissions on ~/.upkuajing and task_data, delete retained result files when no longer needed, and use the contact data only where privacy and anti-spam rules allow it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:60
Finding: API Key May Be Exposed Through Terminal Output and Permissive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/common.py:399
Finding: Personal and Contact Search Results Are Persisted Without Explicit Access Controls or Retention Limits
Content: View full analysis
str: task_dir = get_task_dir(task_id) os.makedirs(task_dir, exist_ok=True) return task_dir ``` From `scripts/common.py:440-450`: ```python def save_task_meta(task_id: str, meta: Dict[str, Any]) -> None: meta_file = get_task_meta_file(task_id) ensure_task_dir(task_id) with open(meta_file, 'w', encoding='utf-8') as f: json.dump(meta, f, ensure_ascii=False, indent=2) ``` From `scripts/common.py:471-483`: ```python def append_result_data(task_id: str, data_list: list) -> None: result_file = get_task_result_file(task_id) ensure_task_dir(task_id) with open(result_file, 'a', encoding='utf-8') as f: for item in data_list: f.write(json.dumps(item, ensure_ascii=False) + '\n') ``` ### Technical Analysis The Skill persists query metadata and API results under `task_data//`. According to the declared functionality and API references, these results may include names, employment history, addresses, email addresses, telephone numbers, WhatsApp details, websites, and social-media links. Directories and files are created without explicit owner-only permissions. Their effective access rights therefore depend on the process umask and parent-directory permissions. No retention period, automatic deletion mechanism, encryption, or user-facing cleanup procedure is implemented. The UUID validation prevents straightforward path traversal, which is a positive control, but it does not protect the confidentiality of data after it has been written. ### Attack Path 1. A user runs a company or person search. 2. The script creates a UUID-based task directory under the project and writes ...[truncated 1076 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Open-Ended Dependency Constraint Allows Unreviewed Future Releases
Content: View full analysis
=0.23.0 ``` From `SKILL.md:18-21`: ```text pip install -r requirements.txt ``` ### Technical Analysis The project depends on the legitimate `httpx` package, and no typosquatted package or untrusted package index was identified. However, the lower-bound-only constraint permits any future `httpx` version to be installed. Consequently, two installations performed at different times may resolve to different code. The project supplies neither an exact version nor package-integrity hashes. A future compromised, malicious, or incompatible release could therefore enter the runtime without a corresponding review of this Skill. Because `httpx` is imported by the shared request and version-checking modules, dependency code executes within the same Python process and receives normal process-level access. ### Attack Path 1. A user follows the installation instructions at a later date. 2. `pip` resolves `httpx>=0.23.0` to the newest release accepted by the environment. 3. That release has not been reviewed as part of this Skill version. 4. If the selected package or one of its transitive dependencies is compromised, its code executes during installation, import, or request handling. 5. The compromised dependency gains the permissions of the user running the Skill and may access process data, local files available to that user, and API credentials loaded by the process. This is a supply-chain hardening weakness rather than evidence that the currently named package is malicious. ### Impact Assessment A compromised dependency would execute with the privileges of the Python process. Potential scope could include: - Reading the API key and locally stored search results. - Altering outbound API requests or r ...[truncated 285 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes remote version checks, parsing local SKILL metadata, and maintaining a version cache on disk, none of which are reflected in the declared search-oriented purpose. While less severe than credential or billing issues, undisclosed update-check and cache behavior expands network and file access beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes remote version checks, parsing local SKILL metadata, and maintaining a version cache on disk, none of which are reflected in the declared search-oriented purpose. While less severe than credential or billing issues, undisclosed update-check and cache behavior expands network and file access beyond user expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior includes remote version checks, parsing local SKILL metadata, and maintaining a version cache on disk, none of which are reflected in the declared search-oriented purpose. While less severe than credential or billing issues, undisclosed update-check and cache behavior expands network and file access beyond user expectations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The instructions direct reading a credential file from ~/.upkuajing/.env and even show using cat to inspect it. Encouraging direct access to raw secret storage increases the chance the API key is exposed to the agent, logs, terminal history, screenshots, or unintended downstream output.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill asks the agent to check for a secret in ~/.upkuajing/.env and, if absent, to create and store a new API key automatically. This combines credential discovery with credential creation and local persistence, expanding the blast radius if the agent environment is compromised or if file access is broader than intended.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The workflow instructs manual addition of an API key to a local .env file or automatic saving of a newly issued key there. Plaintext credential storage in a predictable home-directory path materially increases risk of theft via overbroad file permissions, other tools on the host, backups, or accidental disclosure during troubleshooting.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 64)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 86)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 91)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 75% confidence
Finding: The script writes a newly issued API key directly into a .env file without showing any permission hardening or atomic secure creation. If that file is created with permissive defaults or in a shared environment, other local users/processes may read the credential and abuse the associated account.
Content: Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.
python
"envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.
python
API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents capabilities to read environment variables, access local files under the user's home directory, write credential/cache files, and make network calls, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and makes it harder for a host system or reviewer to constrain the skill to only the minimum operations required.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly enables retrieval of personal contact information including email, phone, and WhatsApp without an accompanying privacy, lawful-use, or compliance warning. In this context, the capability is more dangerous because the skill is aimed at lead generation and people search, which raises risks of privacy violations, spam, and misuse of personal data across jurisdictions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The API documentation explicitly encourages sending request parameters, response data, and error context to an error-reporting endpoint, and although it mentions automatic masking of sensitive fields, it does not define what is masked or warn users not to include personal or regulated data. In this skill’s context—global company and people search, including emails, phone numbers, and WhatsApp details—those payloads can easily contain PII or sensitive business data, so error reporting can become an unintended data exfiltration channel.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: 技能清单描述聚焦于搜索全球企业信息、个人信息及联系方式，用于获客、背调和人才搜索；而本文件模块说明与代码实际实现的是 API 密钥申请、账户信息查询、充值订单创建和接口定价查询。认证与计费管理并非该搜索能力的自然语义组成部分，因此与技能对外宣称的用途存在明显偏离。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains user-facing natural-language strings exclusively in Chinese, including the module description and command help text. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and this file provides no alternative language option or justification for the restriction.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: account_info、new_rec_order 和 price_info 分别访问账户资料、余额、支付链接和接口定价信息，这些都是平台商业账户管理能力，而非搜索企业或个人资料所必需的核心功能。对于一个面向信息检索与线索开发的技能来说，内置充值与计费查询属于上下文不相称的扩展能力。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's natural-language content, including the module description and user-facing error/help strings, is written only in Chinese, which imposes a language choice on users without opt-in. Under the language policy, this can be a locale/language constraint unless the skill explicitly offers alternatives or documents that it is region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: make_request sends caller-provided params to a remote third-party API, and this skill’s purpose is specifically to search for company and personal contact information. Without an explicit disclosure or consent check at the call site, users may unknowingly transmit sensitive search terms, identifiers, or personal data off-device to an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language docstrings and CLI descriptions entirely in Chinese, including the skill title and usage text, with no indication that the language is selectable or that the skill is intentionally restricted to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/common.py:197

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Credential Access

API密钥与充值

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Natural-Language Policy Violations

Unsafe Defaults

Unsafe Defaults

Context-Inappropriate Capability

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Static analysis

File appears to expose a hardcoded API secret or token.