提供谷歌地图线下商户数据批量查询、下载，实现批量搜索，支持按国家、省、市、区域、地域、半径、行业、产品关键词等条件筛选，批量获取商家名称、地址、联系方式等信息，精准挖掘海外采购商，本地推广，提升客户开发效率。帮助地推销售、经销商、品牌团队、区域经理按地理位置、商圈定位商家、分析区域市场密度与覆盖范围、适合区域扩张开店、代理商/经销商寻源、竞品门店点位情报与选址分析，适用于地推获客、线下渠道招帮助地推销售、经销商、品牌团队、区域经理按地理位置、商圈定位商家、分析区域市场密度与覆盖范围、生成销售线索——适合区域扩张开店、代理商/经销商寻源、竞品门店点位情报与选址分析，适用于地推获客、线下渠道招商与门店网络规划。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:19 AM UTC
• Version: 1.0.6

Overview

This is a disclosed paid merchant-search integration, with normal cautions around local API-key storage and optional diagnostic reporting.

Install only if you are comfortable using a paid Upkuajing API key. Keep ~/.upkuajing/.env private, confirm any paid search or recharge action before it runs, and review diagnostic reports before sending so they do not include secrets, customer data, or unnecessary business details.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no explicit permissions, yet its documentation clearly instructs use of environment variables, local file access to ~/.upkuajing/.env, network API calls, and likely local output handling. This mismatch weakens user consent and review because the skill can access sensitive resources without transparent capability disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The stated purpose is merchant search, but the skill also handles account management, pricing lookup, recharge order creation, payment-link retrieval, and error reporting. These extra behaviors expand the trust boundary into billing, credential handling, and outbound reporting, creating a materially different risk profile than the description suggests.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: This module adds outbound network access and local filesystem writes for update checking, which is unrelated to the merchant-search skill’s core advertised function. Even if intended for maintenance, it expands the skill’s attack surface by causing unsolicited communication with a server and persisting data under the user’s home directory, creating privacy, telemetry, and trust-boundary concerns if the endpoint or base URL is untrusted or later compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document explicitly encourages sending `requestParams`, `responseData`, and error `context` to a reporting endpoint, which can easily include sensitive business data, credentials, tokens, customer information, or internal stack traces. Although it states that sensitive fields are 'automatically desensitized', it does not define the scope, guarantees, or require user/operator review before transmission, so this creates a real risk of unintended data exfiltration to the platform.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically writes a newly issued API key to a local .env file without first obtaining explicit user confirmation or setting restrictive file permissions. This can expose credentials to other local users, backups, shell tooling, or accidental inclusion in logs or source control, especially on shared or misconfigured systems.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script sends a caller-supplied `context` field and request metadata to a platform endpoint without any data minimization, redaction, or explicit consent/notice in the tool itself. If `context` contains prompts, secrets, tokens, user content, or internal paths from failure cases, the error-reporting path can exfiltrate sensitive data to the platform unnecessarily.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: Writing the API key in plaintext to a .env file constitutes sensitive credential storage on disk. If file permissions are weak, the home directory is shared, or the file is later committed or backed up insecurely, an attacker can recover the key and use the paid API or access associated account resources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: The dependency is specified with a lower bound only (httpx>=0.23.0), which allows future unreviewed versions to be installed. This can introduce breaking changes or newly published compromised releases into the build, reducing reproducibility and increasing supply-chain risk.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197