Comprehensive overseas corporate data and business intelligence lookup built exclusively for global B2B practitioners. Run worldwide company and contact searchqueries tailored to cross-border exporters.Locate international enterprises and validate full business credentials: corporate emails, business phone lines andemployee job titles. Filter high-intent export sales leads and qualified prospects for global trade teams. Spot purchasing decision-makers, source reliablesuppliers and accelerate client acquisition for exporters, trading firms, sourcing agents and internal sales teams. All core features are accessible through oneunified search query.Optimized for B2B global prospecting, supplier development and export-focused sales lead generation workflows.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 1.0.10

Overview

The skill is coherent but should be reviewed carefully because it can retrieve personal contact data, incur paid API usage, and stores API keys in a plaintext local file.

Install only if you are comfortable using a paid third-party B2B data service that may return personal professional contact details. Use a secret manager or environment variable instead of printing or pasting the API key, restrict ~/.upkuajing/.env permissions if you use it, confirm costs before bulk searches or enrichment, and avoid sending raw contact data or sensitive query results in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66
• Finding: API Key May Be Exposed Through Documented Plaintext Inspection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66–75 **Vulnerability Type**: Plaintext credential disclosure **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file: ```bash cat ~/.upkuajing/.env ``` **Example file content**: ``` UPKUAJING_API_KEY=your_api_key_here ``` ### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; ``` ### Technical Analysis The Skill legitimately needs to determine whether an UpKuaJing API key is configured. However, the documented `cat ~/.upkuajing/.env` command prints the entire credential file rather than checking only whether the required variable exists. When an agent or user follows this instruction, the full API key can appear in terminal output, agent transcripts, debugging records, screenshots, command logs, or other monitoring systems. Printing the secret exceeds the minimum privilege necessary for checking whether it is configured. The underlying code in `scripts/common.py` limits credential retrieval to `UPKUAJING_API_KEY` and sends it to the fixed UpKuaJing HTTPS API endpoint. No evidence of intentional credential exfiltration was identified. The vulnerability is specifically the unnecessary disclosure encouraged by the documentation. ### Attack Path 1. A user or agent follows the documented API-key setup procedure. 2. The command `cat ~/.upkuajing/.env` is executed. 3. The complete API key is printed in plaintext. 4. Terminal output or the agent conversation is retained in logs, monitoring systems, or shared session history. 5. A person or system with access to those records obtains the key. 6. The exposed key is used to authenticate to the UpKuaJing API and perform operations under the victim's account. ### Impact Assessment An attacker who obtains the key may be able to: - Make authenticated UpKuaJing API requests as the affected account. - Consume account ...[truncated 405 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to run `cat ~/.upkuajing/.env`. 2. Prefer checking the environment variable without printing its value. 3. If the fallback file must be checked, report only whether the key is present, for example through a helper that returns a Boolean result. 4. Redact credentials in all output, diagnostics, exceptions, and logs. If identification is necessary, expose only a short, non-sensitive fingerprint. 5. Update the documentation to instruct users never to paste API keys into agent conversations or other recorded channels. 6. Prefer injecting `UPKUAJING_API_KEY` through the host platform's secret-management mechanism rather than manually displaying or editing the secret. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:60
• Finding: API Key File Is Created Without Enforced Owner-Only Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auth.py`, lines 60–73 **Vulnerability Type**: Insecure local secret-file permissions **Risk Level**: Medium ### Vulnerable Code Snippet ```python # 确保 ~/.upkuajing 目录存在 try: UPKUAJING_DIR.mkdir(parents=True, exist_ok=True) except OSError as e: return { "success": False, "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。", "envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n") ``` ### Technical Analysis The script saves a newly issued API key to `~/.upkuajing/.env`, but it does not explicitly enforce restrictive permissions on either the directory or the file. The effective permissions therefore depend on the process umask and any permissions already present on `~/.upkuajing`. On systems with a permissive umask or a pre-existing broadly accessible directory, the resulting file may be readable by other local users. Because the file contains a reusable Bearer credential in plaintext, confidentiality depends directly on filesystem access controls. Storing the API key is consistent with the Skill's declared authentication functionality. The security issue is that the implementation does not guarantee owner-only access and therefore does not adequately protect the stored secret. ### Attack Path 1. A user runs `python scripts/auth.py --new_key`. 2. The API returns a new key. 3. The script creates `~/.upkuajing` and writes `.env` using default permissions inherited from the process umask. 4. On a system with permissive permissions, another local account can traverse the directory and read the file. 5. The local attacker extracts `UPKUAJING_API_KEY`. 6. The attacker uses the credential against the UpKuaJing API under the victim's account. This path requires local filesystem access and permissions that allow the other account to read ...[truncated 577 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create `~/.upkuajing` with owner-only permissions equivalent to `0700`. 2. Create the credential file atomically with owner read/write permissions equivalent to `0600`. 3. Avoid relying exclusively on the process umask. 4. After writing, verify the resulting mode and correct overly broad permissions where supported. 5. Refuse to use the credential file, or emit a prominent warning, if it is owned by another user or is readable by group or other users. 6. Avoid overwriting the file through an operation that could follow an attacker-controlled symbolic link. Use exclusive or no-follow creation semantics where the platform supports them. 7. Prefer the runtime environment or a dedicated operating-system secret store over a persistent plaintext file. 8. Rotate any key that may previously have been stored with broad permissions. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Dependency Specification Allows Unreviewed Future Releases<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt`, line 1 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code Snippet ```text httpx>=0.23.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version and places no upper bound on `httpx`. Running the documented installation command can therefore install a future release that was not part of this audit. The requirements file also contains no package hashes. Consequently, installations are not cryptographically tied to a reviewed artifact set. This reduces reproducibility and expands supply-chain exposure if a future release is compromised, malicious, or incompatible. The audit found no evidence that the current `httpx` package name is a typosquat or that the Skill intentionally installs from an unsafe custom source. The risk arises from accepting unreviewed future versions rather than from a confirmed malicious dependency currently shipped with the project. ### Attack Path 1. A user installs dependencies with `pip install -r requirements.txt`. 2. The package resolver selects the newest release satisfying `httpx>=0.23.0`. 3. A future selected release contains compromised package code, a malicious transitive dependency, or a security regression. 4. Package code is installed and later imported when the Skill scripts run. 5. The compromised code executes with the privileges of the user running the Skill. This exploitation path is conditional on compromise or unsafe behavior in a dependency version selected after the audit. ### Impact Assessment The potential impact is bounded by the privileges of the user or agent environment running the Skill. A compromised dependency could theoretically access: - The `UPKUAJING_API_KEY` available to the process. - Query parameters and API responses handled by the scripts. - Locally stored task results and metadata. - Files and network resources accessible to the executing user ...[truncated 155 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `httpx` to an exact version that has been reviewed and tested. 2. Generate a lock file that also pins all transitive dependencies. 3. Record package hashes and install with hash verification, such as pip's `--require-hashes` mode. 4. Use an automated dependency-update process that performs security scanning and regression testing before changing pinned versions. 5. Periodically review the pinned version for published vulnerabilities and update through a controlled process. 6. Install dependencies in an isolated virtual environment with only the permissions required by the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill includes telemetry/error reporting that submits request metadata and execution context to the platform, but this behavior is not clearly foregrounded in the primary description. Hidden or under-disclosed outbound reporting can leak business queries, identifiers, or operational metadata, especially in a lead-generation context involving personal contact data.

Credential Access

High

• Category: Privilege Escalation

Content

This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env
```
**Example file content**:
```

• Confidence: 97% confidence
• Finding: The skill instructs reading a local .env file that stores the API key, including an explicit command to display its contents. In an agent environment, this is credential exposure behavior: it can reveal secrets to the model, logs, transcripts, or downstream tooling beyond the minimum needed for authentication.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The workflow tells the agent to check for the API key in a local .env file and potentially handle user-supplied credentials for manual storage. This expands secret-handling surface area and risks accidental disclosure, insecure persistence, or logging of credentials in a conversational workflow.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 96% confidence
• Finding: The skill not only reads secret state from .env but also auto-saves newly created API keys to a local file. Automatic persistence of freshly issued credentials increases the chance of compromise through file exposure, weak filesystem permissions, backups, or later accidental disclosure by the agent.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 93% confidence
• Finding: The script writes a newly issued API key directly into a .env file in plaintext without setting restrictive permissions. On multi-user systems or in environments where home-directory files are backed up, synced, or broadly readable, this can expose the credential and allow unauthorized use of the service API.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 90% confidence
• Finding: The error path encourages manual setting of the API key and returns the environment file path, reinforcing a workflow centered on plaintext secret handling. In the context of a lead-generation skill that accesses verified business contacts, compromise of the API key could enable unauthorized data retrieval or account misuse.

Credential Access

High

• Category: Privilege Escalation

Content

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares capabilities that include environment access, local file reads/writes, and network use, but it does not define any explicit tool scope or permission boundary. In an agent setting, this weakens containment and makes it harder to enforce least privilege, especially because the skill handles API keys, writes local state, and can contact remote services.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are broad enough to activate on common requests such as finding people, contacts, or companies, which increases the chance that the skill runs in contexts where users did not intend lead-generation, contact discovery, or fee-incurring actions. In a skill that can retrieve personal contact details and initiate paid API calls, overbroad activation materially raises misuse risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises retrieval of verified personal contact details, including emails, phone numbers, and WhatsApp profiles, without a prominent privacy or acceptable-use warning. In this context, the omission increases the risk of privacy-invasive enrichment, unsolicited outreach, and collection of personal data without clear user awareness or policy gating.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The note states that product names and industry names must be in English, which is a language constraint expressed as a mandatory rule. This forces a specific language/locale behavior without offering user choice or explaining a justified regional/compliance need.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly exposes access to employee contact data via fields like `person_contact_show` without any privacy warning, consent constraints, or permissible-use guidance. In the context of a lead-generation skill that advertises verified emails, phone numbers, and WhatsApp profiles, this materially increases the risk of privacy abuse, targeted phishing, spam, and unlawful processing of personal data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API supports filtering people by gender, a sensitive/protected attribute in many contexts, without any warning, purpose limitation, or anti-discrimination guardrails. In a people-search and lead-generation workflow, this can enable discriminatory targeting or exclusion and create regulatory and reputational risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API reference explicitly supports discovery of personal contact channels such as email, phone, and WhatsApp for professional contacts, but provides no privacy, consent, lawful-basis, or acceptable-use constraints. In the context of a lead-generation skill, this materially increases the risk of bulk harvesting, unsolicited outreach, and misuse of personal data across jurisdictions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and error context to a platform error-reporting API, but it does not require explicit user notice, consent, or strict minimization before transmission. In a skill focused on company/contact search and verified emails/phone numbers, these fields can easily contain personal data, business-sensitive queries, API outputs, or stack traces, creating a meaningful privacy and data-sharing risk if reported automatically.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file contains user-facing natural language that is exclusively Chinese in the module docstring, and the CLI also presents Chinese-only descriptions/help text. Per the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:87