Comprehensive overseas corporate data and business intelligence lookup built exclusively for global B2B practitioners. Run worldwide company and contact searchqueries tailored to cross-border exporters.Locate international enterprises and validate full business credentials: corporate emails, business phone lines andemployee job titles. Filter high-intent export sales leads and qualified prospects for global trade teams. Spot purchasing decision-makers, source reliablesuppliers and accelerate client acquisition for exporters, trading firms, sourcing agents and internal sales teams. All core features are accessible through oneunified search query.Optimized for B2B global prospecting, supplier development and export-focused sales lead generation workflows.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 1.0.10

Overview

The skill is coherent but should be reviewed carefully because it can retrieve personal contact data, incur paid API usage, and stores API keys in a plaintext local file.

Install only if you are comfortable using a paid third-party B2B data service that may return personal professional contact details. Use a secret manager or environment variable instead of printing or pasting the API key, restrict ~/.upkuajing/.env permissions if you use it, confirm costs before bulk searches or enrichment, and avoid sending raw contact data or sensitive query results in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66

Finding

API Key May Be Exposed Through Documented Plaintext Inspection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:60

Finding

API Key File Is Created Without Enforced Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Specification Allows Unreviewed Future Releases

Content

View full analysis

=0.23.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version and places no upper bound on `httpx`. Running the documented installation command can therefore install a future release that was not part of this audit. The requirements file also contains no package hashes. Consequently, installations are not cryptographically tied to a reviewed artifact set. This reduces reproducibility and expands supply-chain exposure if a future release is compromised, malicious, or incompatible. The audit found no evidence that the current `httpx` package name is a typosquat or that the Skill intentionally installs from an unsafe custom source. The risk arises from accepting unreviewed future versions rather than from a confirmed malicious dependency currently shipped with the project. ### Attack Path 1. A user installs dependencies with `pip install -r requirements.txt`. 2. The package resolver selects the newest release satisfying `httpx>=0.23.0`. 3. A future selected release contains compromised package code, a malicious transitive dependency, or a security regression. 4. Package code is installed and later imported when the Skill scripts run. 5. The compromised code executes with the privileges of the user running the Skill. This exploitation path is conditional on compromise or unsafe behavior in a dependency version selected after the audit. ### Impact Assessment The potential impact is bounded by the privileges of the user or agent environment running the Skill. A compromised dependency could theoretically access: - The `UPKUAJING_API_KEY` available to the process. - Query parameters and API responses handled by the scripts. - Locally stored task results and metadata. - Files and network resources accessible to the executing user ...[truncated 155 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading a local .env file that stores the API key, including an explicit command to display its contents. In an agent environment, this is credential exposure behavior: it can reveal secrets to the model, logs, transcripts, or downstream tooling beyond the minimum needed for authentication.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The workflow tells the agent to check for the API key in a local .env file and potentially handle user-supplied credentials for manual storage. This expands secret-handling surface area and risks accidental disclosure, insecure persistence, or logging of credentials in a conversational workflow.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill not only reads secret state from .env but also auto-saves newly created API keys to a local file. Automatic persistence of freshly issued credentials increases the chance of compromise through file exposure, weak filesystem permissions, backups, or later accidental disclosure by the agent.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 64)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 86)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 91)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The script writes a newly issued API key directly into a .env file in plaintext without setting restrictive permissions. On multi-user systems or in environments where home-directory files are backed up, synced, or broadly readable, this can expose the credential and allow unauthorized use of the service API.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The error path encourages manual setting of the API key and returns the environment file path, reinforcing a workflow centered on plaintext secret handling. In the context of a lead-generation skill that accesses verified business contacts, compromise of the API key could enable unauthorized data retrieval or account misuse.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares capabilities that include environment access, local file reads/writes, and network use, but it does not define any explicit tool scope or permission boundary. In an agent setting, this weakens containment and makes it harder to enforce least privilege, especially because the skill handles API keys, writes local state, and can contact remote services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to activate on common requests such as finding people, contacts, or companies, which increases the chance that the skill runs in contexts where users did not intend lead-generation, contact discovery, or fee-incurring actions. In a skill that can retrieve personal contact details and initiate paid API calls, overbroad activation materially raises misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises retrieval of verified personal contact details, including emails, phone numbers, and WhatsApp profiles, without a prominent privacy or acceptable-use warning. In this context, the omission increases the risk of privacy-invasive enrichment, unsolicited outreach, and collection of personal data without clear user awareness or policy gating.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The note states that product names and industry names must be in English, which is a language constraint expressed as a mandatory rule. This forces a specific language/locale behavior without offering user choice or explaining a justified regional/compliance need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation explicitly exposes access to employee contact data via fields like person_contact_show without any privacy warning, consent constraints, or permissible-use guidance. In the context of a lead-generation skill that advertises verified emails, phone numbers, and WhatsApp profiles, this materially increases the risk of privacy abuse, targeted phishing, spam, and unlawful processing of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The API supports filtering people by gender, a sensitive/protected attribute in many contexts, without any warning, purpose limitation, or anti-discrimination guardrails. In a people-search and lead-generation workflow, this can enable discriminatory targeting or exclusion and create regulatory and reputational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The API reference explicitly supports discovery of personal contact channels such as email, phone, and WhatsApp for professional contacts, but provides no privacy, consent, lawful-basis, or acceptable-use constraints. In the context of a lead-generation skill, this materially increases the risk of bulk harvesting, unsolicited outreach, and misuse of personal data across jurisdictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs agents to send request parameters, response payloads, and error context to a platform error-reporting API, but it does not require explicit user notice, consent, or strict minimization before transmission. In a skill focused on company/contact search and verified emails/phone numbers, these fields can easily contain personal data, business-sensitive queries, API outputs, or stack traces, creating a meaningful privacy and data-sharing risk if reported automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains user-facing natural language that is exclusively Chinese in the module docstring, and the CLI also presents Chinese-only descriptions/help text. Per the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.