Security audit

提供谷歌地图线下商户数据批量查询、下载，实现批量搜索，支持按国家、省、市、区域、地域、半径、行业、产品关键词等条件筛选，批量获取商家名称、地址、联系方式等信息，精准挖掘海外采购商，本地推广，提升客户开发效率。帮助地推销售、经销商、品牌团队、区域经理按地理位置、商圈定位商家、分析区域市场密度与覆盖范围、适合区域扩张开店、代理商/经销商寻源、竞品门店点位情报与选址分析，适用于地推获客、线下渠道招帮助地推销售、经销商、品牌团队、区域经理按地理位置、商圈定位商家、分析区域市场密度与覆盖范围、生成销售线索——适合区域扩张开店、代理商/经销商寻源、竞品门店点位情报与选址分析，适用于地推获客、线下渠道招商与门店网络规划。

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate merchant-search integration, but it needs review because it can create and store an API key for billable account actions without enforcing safe local file permissions.

Review this skill before installing if you will use it with a funded Upkuajing account. Store the API key carefully, consider setting ~/.upkuajing/.env permissions to 0600, confirm paid searches before running them, and avoid including sensitive request or response data in error reports.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:62
Finding: API Key Stored Without Enforced Restrictive File Permissions
Content: View full analysis
Vulnerability Details

File Location: scripts/auth.py, lines 62–73
Vulnerability Type: Plaintext credential storage with permissions inherited from the process umask
Risk Level: Medium

Vulnerable Code:

python
# Ensure ~/.upkuajing directory exists try: UPKUAJING_DIR.mkdir(parents=True, exist_ok=True) except OSError as e: return { "success": False, "message": f"API key application succeeded, but directory creation failed: {str(e)}.", "envFilePath": str(env_file) } # Save to .env file try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The API key is written in plaintext to ~/.upkuajing/.env, but the code does not explicitly assign restrictive permissions to either the directory or credential file. The effective permissions therefore depend on the process umask.

Under a permissive umask, the file could be readable by other local users. The implementation also opens an existing path without checking whether it is a symbolic link and does not repair insecure permissions on an existing file. Because the API key authorizes account-related and potentially billable operations, credential storage should not rely on ambient process configuration.

Access to this dedicated credential path is functionally justified by the Skill's authenticated API operations and is disclosed in SKILL.md. The issue is therefore not the credential access itself, but the failure to securely protect the stored secret.

Attack Path

A victim runs python scripts/auth.py --new_key.

The API returns a new API key.

The script creates ~/.upkuajing and writes the key to ~/.upkuajing/.env using permissions derived from the current umask.

If those permissions permit access by another local account, that account reads the plaintext key.

The attacker uses the stolen Bearer token wit ...[truncated 1005 chars]
Remediation: View remediation
Remediation Suggestions

Create ~/.upkuajing with mode 0700 and explicitly repair its permissions if it already exists.

Create the credential file atomically with mode 0600, rather than relying on the process umask.

Use flags such as O_CREAT, O_WRONLY, O_TRUNC, and O_NOFOLLOW where supported to prevent following symbolic links.

Verify that the destination is a regular file owned by the current user before replacing an existing file.

Write the key to a securely created temporary file in the same directory, flush it, and atomically rename it into place.

Prefer an operating-system credential store or secret manager when available.

Never include the complete key in logs, exceptions, command output, or diagnostic reports.

Document the required ownership and permissions and warn users when insecure existing permissions are detected.

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded Dependency Version and Missing Integrity Verification
Content: View full analysis
Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Non-reproducible third-party dependency installation
Risk Level: Low

Vulnerable Code:

text
httpx>=0.23.0

The installation instruction in SKILL.md invokes:

bash
pip install -r requirements.txt

Technical Analysis

The lower-bound-only constraint permits installation of any current or future httpx release accepted by the resolver. It also leaves transitive dependency versions unresolved and does not provide package hashes or a lock file.

Consequently, separate installations can execute different dependency code despite using the same audited Skill source. A future incompatible or compromised release could be selected automatically. The absence of hash verification also prevents the installer from confirming that downloaded artifacts match versions reviewed by the project.

No typosquatted package, malicious package source, or currently known compromised version was identified in the audited project. This finding concerns supply-chain hardening and reproducibility rather than evidence that the declared dependency is presently malicious.

Attack Path

A user follows the documented instruction to run pip install -r requirements.txt.

The package resolver selects the newest available release satisfying the open-ended constraint, together with then-current transitive dependencies.

If a selected future release is compromised, malicious code can execute during installation, import, or runtime.

Because httpx is imported by the Skill's request and version-checking modules, compromised runtime code would execute in the context of the user running the scripts.

That code could access files and environment variables available to the process, including the API key, and could alter or observe API traffic.

This exploitation path depends on compromise of the package repository, a permitte ...[truncated 726 chars]
Remediation: View remediation
Remediation Suggestions

Pin httpx to a specifically reviewed version instead of using an unrestricted lower bound.

Generate a lock file that records all transitive dependency versions.

Record approved distribution hashes and install with pip --require-hashes.

Use an isolated virtual environment rather than installing into a shared or privileged Python environment.

Obtain packages only from an explicitly configured trusted index.

Automate vulnerability scanning and dependency update reviews.

Test and audit dependency upgrades before changing the lock file.

Avoid running package installation or Skill scripts with administrative privileges.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version checks, remote API communication, local cache writes, metadata reads, and upgrade notices are not inherently malicious, but they are undisclosed auxiliary behaviors outside the stated lead-search purpose. Undeclared update/telemetry-like behavior expands the attack surface and can create privacy or integrity risks if the remote endpoint or cached state is abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Version checks, remote API communication, local cache writes, metadata reads, and upgrade notices are not inherently malicious, but they are undisclosed auxiliary behaviors outside the stated lead-search purpose. Undeclared update/telemetry-like behavior expands the attack surface and can create privacy or integrity risks if the remote endpoint or cached state is abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version checks, remote API communication, local cache writes, metadata reads, and upgrade notices are not inherently malicious, but they are undisclosed auxiliary behaviors outside the stated lead-search purpose. Undeclared update/telemetry-like behavior expands the attack surface and can create privacy or integrity risks if the remote endpoint or cached state is abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Version checks, remote API communication, local cache writes, metadata reads, and upgrade notices are not inherently malicious, but they are undisclosed auxiliary behaviors outside the stated lead-search purpose. Undeclared update/telemetry-like behavior expands the attack surface and can create privacy or integrity risks if the remote endpoint or cached state is abused.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Version checks, remote API communication, local cache writes, metadata reads, and upgrade notices are not inherently malicious, but they are undisclosed auxiliary behaviors outside the stated lead-search purpose. Undeclared update/telemetry-like behavior expands the attack surface and can create privacy or integrity risks if the remote endpoint or cached state is abused.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill explicitly instructs checking a local credential file at ~/.upkuajing/.env for UPKUAJING_API_KEY, indicating access to locally stored secrets. Any skill that reads or encourages handling secrets from local env files increases the risk of credential disclosure, accidental logging, or misuse—especially when combined with network access and loosely scoped permissions.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
### **API密钥未设置** 首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；如果 UPKUAJING_API_KEY 未设置，提示用户选择： 1. 用户已有密钥：用户自行添加（手动添加到 ~/.upkuajing/.env 文件） 2. 用户没有密钥：引导用户前往 [跨境魔方开放平台](https://developer.upkuajing.com/) 申请等待用户选择；

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 64)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 86)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 91)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: Writing the issued API key into a .env file constitutes local credential persistence and can become a credential exposure risk if the file permissions are weak, the location is backed up broadly, or users later copy it into project directories. In this context, the danger comes from insecure storage defaults rather than active credential theft.
Content: Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.
python
"envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.
python
API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares capabilities that require environment access, local file interaction, and network use, but it does not explicitly scope or constrain those powers with a permissions/allowed-tools declaration. That makes the skill harder to sandbox and review, and increases the risk that credential files, local task data, or network endpoints are accessed beyond what users reasonably expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction says to explain exceptions to the user "用自然语言向用户解释异常情况", and throughout the file all user-facing guidance is written only in Chinese with no opt-in or alternative locale option. This creates a natural-language locale constraint that is not documented as region-specific or presented as a user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file’s user-facing documentation is entirely in Chinese, including the title and parameter descriptions, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, a language-specific constraint should either be opt-in or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The API documentation explicitly allows sending request parameters, response payloads, and error context to a central error-reporting endpoint. Even though it says sensitive fields will be automatically redacted, it does not define the redaction scope or require callers to minimize or review what is sent, creating a real risk of leaking personal data, credentials, business data, or model inputs during failure handling. In this skill context, merchant-search workflows may process customer targeting data and operational identifiers, so shipping raw debugging artifacts off-box increases privacy and data-governance exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 技能清单描述该技能用于基于 Google Maps 挖掘海外本地企业并按区域、行业、评分筛选客户线索，但本文件模块说明和后续实现均围绕“认证管理”、账户余额、充值订单和平台接口定价。此类账号与计费管理并不是地图商家搜索能力的明显实现细节，而是与宣称用途不同的附加行为。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI triggers network operations that create credentials and retrieve account/payment-related data without an explicit user-facing disclosure of what remote actions will occur. In an agent-skill context, undisclosed remote side effects are risky because users may invoke a seemingly simple command without realizing it provisions secrets or interacts with billing/account systems.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes a newly issued API key directly to a local .env file without prompting the user or clearly warning beforehand that a credential will be persisted on disk. Persisting secrets by default can expose them to other local users, backups, shell tooling, or accidental inclusion in logs or source control if the path is later copied into a project.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: new_rec_order() 调用 /agent/auth/pay/url 创建充值订单，这是支付/充值能力，不是地图商家搜索、筛选目标客户所必需的实现步骤。该能力属于平台商业化运营支持，而非技能描述中的数据挖掘或搜索功能。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file defines request and response logging helpers that write endpoint names and full request/response payloads to ~/.upkuajing/logs when logging is enabled. Although the behavior is commented in code, there is no user-facing warning, confirmation, or visible disclosure at the point of logging, and these payloads may contain user or system data received from or sent to the external API.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Unsafe Defaults

Unsafe Defaults

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings