Google Maps business data extraction paired with bulk search and batch data download capabilities for global B2B lead generation. Filter search results bycountry, state, city, district, search radius, industry and product keywords to batch collect business names, physical addresses and full contact details.Precisely pinpoint overseas buyers and local enterprises to streamline end-to-end lead development workflows. Support field sales reps, distributors, brandoperation teams and regional managers to target merchants in designated zones and commercial districts. Analyze regional market density and coverage data togenerate high-qualified sales prospects. Fully optimized for regional business expansion, new outlet setup, distributor recruitment, competitor locationtracking and territory planning for offline channel development.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:45 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches its merchant-search purpose, but it deserves review because it handles paid API access, stores credentials and search results locally, and performs an under-disclosed automatic version-check request.

Install only if you are comfortable giving this skill access to an UpKuaJing API key and using a paid merchant-search service. Before running it, restrict permissions on ~/.upkuajing/.env and any generated task_data files, confirm costs before searches, review payment-order URLs carefully, and avoid sending sensitive business data in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API credential file is created without explicitly restrictive permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py:62-73
Vulnerability Type: Insecure storage of authentication credentials
Risk Level: Medium

python

try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The code stores a reusable Bearer API credential in ~/.upkuajing/.env, but creates both the parent directory and credential file using permissions derived solely from the process umask. It does not enforce owner-only permissions such as 0700 for the directory and 0600 for the file.

On a multi-user system with an unusually permissive umask, the resulting credential file may be readable by other local users. The behavior is functionally necessary because authenticated API operations require the key, and the code only accesses the documented UPKUAJING_API_KEY; the issue is the security of the persistence mechanism rather than excessive credential scope.

Attack Path

1. A user runs python scripts/auth.py --new_key.
2. The service returns an API key.
3. The script creates ~/.upkuajing and writes the key to .env using process-default permissions.
4. If the effective permissions permit group or world access, another local account reads the file.
5. The attacker uses the stolen Bearer token against the UpKuaJing API.

Impact Assessment

A local attacker who obtains the credential may perform authenticated operations available to that API key. Depending on server-side authorization, this could include consuming paid merchant-search calls, viewing account information, retrieving pricing details, submitting error reports, or creating paymen ...[truncated 214 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700.
• Create the credential file atomically with mode 0600, for example using os.open with O_CREAT | O_WRONLY | O_TRUNC and an explicit mode.
• Apply chmod(0o700) and chmod(0o600) to existing directories and files before trusting them.
• Reject symbolic links and verify that the destination is a regular file owned by the current user.
• Use atomic replacement through a securely created temporary file to prevent partial writes.
• Prefer an operating-system credential store when one is available.
• Avoid disclosing even a prefix of an existing API key in user-facing messages.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/common.py:419

Finding

Merchant search records and task metadata are persisted without enforced access restrictions

Content

View full analysis

Vulnerability Details

File Location: scripts/common.py:419-421, 448-451, 478-482
Vulnerability Type: Insecure local storage of collected data
Risk Level: Medium

python

task_dir = get_task_dir(task_id)
os.makedirs(task_dir, exist_ok=True)
return task_dir

python

meta_file = get_task_meta_file(task_id)
ensure_task_dir(task_id)
with open(meta_file, 'w', encoding='utf-8') as f:
    json.dump(meta, f, ensure_ascii=False, indent=2)

python

result_file = get_task_result_file(task_id)
ensure_task_dir(task_id)
with open(result_file, 'a', encoding='utf-8') as f:
    for item in data_list:
        f.write(json.dumps(item, ensure_ascii=False) + '\n')

Technical Analysis

Merchant results, search parameters, pagination cursors, and task state are written beneath the project-level task_data directory using filesystem permissions inherited from the process umask. The code does not explicitly restrict task directories or files to the current user.

The UUID validation in get_task_dir substantially reduces path-traversal risk, but UUID-based path names are not an access-control mechanism. If the project directory or generated files are readable by other local users, collected lead data and search history may be exposed.

The stored API responses may contain business addresses, coordinates, and contact-related merchant information. Although much of this may originate from public business listings, the aggregated dataset and the user's search strategy can still be commercially sensitive.

Attack Path

1. A user executes a merchant search.
2. The script creates a UUID-named task directory under task_data.
3. Search parameters are stored in meta.json, and merchant records are appended to result.jsonl.
4. The generated directory and files inherit a permissive umask or reside in a shared project directory.
5. Another local user enumerates task_data and reads the met ...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

• Create the root task-data directory and each task directory with mode 0700.
• Create meta.json and result.jsonl with mode 0600.
• Verify file ownership and reject symbolic links before reading, truncating, or appending.
• Use atomic writes for task metadata to prevent corruption.
• Consider storing task data in a private per-user application-data directory rather than inside the Skill installation.
• Document retention behavior and provide a command to securely remove completed task data.
• If task integrity is important, validate metadata structure and prevent untrusted local modification from silently changing resumed search parameters.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-party HTTP dependency is not reproducibly pinned

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unbounded dependency resolution
Risk Level: Low

text

httpx>=0.23.0

The documented installation command in SKILL.md:18 is:

text

pip install -r requirements.txt

Technical Analysis

The requirement specifies only a minimum version and permits installation of any later httpx release and its resolver-selected transitive dependencies. Consequently, two installations performed at different times may execute different dependency code without any change to the audited Skill.

No typosquatted package, untrusted package index, or currently malicious dependency was identified. The risk is that the broad version constraint weakens reproducibility and expands future supply-chain and compatibility exposure.

Attack Path

1. A user follows the documented dependency installation command.
2. The package resolver selects the latest release satisfying httpx>=0.23.0.
3. That release or one of its transitive dependencies has not necessarily been reviewed with this Skill.
4. A compromised, malicious, or incompatible future release is installed and executes during import or normal HTTP processing.
5. Such dependency code runs with the same local privileges as the Skill.

Impact Assessment

A compromised dependency could theoretically access the API credential, merchant result files, process environment, or network because it executes in the same Python process. An incompatible update could also alter TLS, proxy, timeout, or request behavior.

No present compromise was established, so the practical finding is limited to avoidable supply-chain uncertainty rather than evidence of active malicious execution.

Remediation

View remediation

Remediation Suggestions

• Pin httpx and all transitive dependencies to reviewed versions.
• Generate a lock file and include cryptographic hashes, such as through pip-compile --generate-hashes.
• Install with hash verification enabled where practical.
• Use a controlled package index and disable unintended extra indexes in automated environments.
• Review and update pinned versions regularly so reproducibility does not prevent security patching.
• Add automated dependency vulnerability scanning to the release process.

other

Note

• Location: scripts/common.py:199

Finding

Normal API operations trigger an ancillary automatic version-check request

Content

View full analysis

Vulnerability Details

File Location: scripts/common.py:199-200 and scripts/version_check.py:97-103
Vulnerability Type: Undisclosed ancillary telemetry and network side effect
Risk Level: Low

python

check_and_notify(API_BASE_URL)

python

try:
    url = f"{api_base_url}/agent/api/skills/version"
    headers = {"Content-Type": "application/json"}

    with httpx.Client(timeout=10.0) as client:
        response = client.post(url, json={"name": skill_name}, headers=headers)
        response.raise_for_status()

The transmitted value is derived from the installation directory name:

python

def get_skill_name() -> str:
    return os.path.basename(SKILL_BASE_DIR)

Technical Analysis

make_request invokes check_and_notify before performing the user-requested operation. On the first eligible invocation each day, this sends a separate unauthenticated POST request to the same API provider and caches the result under ~/.upkuajing/version_cache.json.

The request does not include the API key, system inventory, or arbitrary file contents. However, it transmits the local installation directory basename rather than a fixed identifier from Skill metadata. In unusual installations, that basename may contain limited local context. The additional request is not clearly disclosed in the Skill documentation and is not required to perform merchant or geography queries.

Attack Path

1. A user invokes an API-backed Skill command.
2. make_request calls the version-check routine before the requested API call.
3. The routine derives the Skill name from the local installation directory basename.
4. It sends that value to https://openapi.upkuajing.com/agent/api/skills/version.
5. The provider observes invocation timing and the transmitted basename, and the script writes a local daily cache.

Impact Assessment

The provider receives limited telemetry about Skill invocation ...[truncated 342 chars]

Remediation

View remediation

Remediation Suggestions

• Disclose the automatic version check and local cache in SKILL.md.
• Make the check opt-in, or provide a documented environment variable or command-line option to disable it.
• Use the fixed Skill name from trusted front matter rather than the local directory basename.
• Avoid performing ancillary network calls from the generic request path unless explicitly enabled.
• Keep version responses informational only; never automatically download or execute update payloads.
• If telemetry is retained server-side, document its purpose, retention period, and privacy treatment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code chunk does not perform any Google Maps scraping, business-data collection, geographic/radius filtering, market analysis, or lead generation. Instead, its sole purpose is service authentication and billing management: requesting/storing API keys, checking account balances, creating recharge orders, and retrieving pricing. This is a materially different primary purpose and introduces undeclared capabilities related to credential handling and payments. Therefore the declared description does not accurately represent the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code chunk is a common utility module for a completely different service (openapi.upkuajing.com), likely related to a cross-border commerce API. It handles API authentication, HTTP requests, logging, JSON/file utilities, and task storage. It does not contain any code to access Google Maps, scrape map listings, apply radius-based filters, collect business contact data, or perform the specific lead-generation and market-density analyses described. While this may be supporting infrastructure for some larger skill, this supplied chunk’s observable behavior materially differs from the declared Google Maps scraping purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not scrape Google Maps, collect merchant data, perform radius-based searches, analyze markets, or generate sales leads. Its sole purpose is operational telemetry: reporting Agent/Skill exceptions to a backend service. This is a materially different primary purpose from the declared business-data scraping and market research functionality, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on Google Maps business scraping and sales-lead/market-analysis capabilities. The supplied code only fetches country/province/city lists from '/agent/common/*/list' endpoints on another platform, with optional country_id filtering for province/city lookups. Its primary purpose is geographic metadata retrieval, not business discovery or contact extraction. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises Google Maps business scraping, merchant contact extraction, radius-based filtering, distributor sourcing, and market research. The supplied code does none of those things. Its sole purpose is skill version management: determining the current skill version, checking a server for updates once per day, caching results locally, and notifying about upgrades. This is a materially different primary purpose and an undeclared capability unrelated to the described Google Maps/business intelligence functionality.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs checking for and manually managing an API key in ~/.upkuajing/.env, which normalizes direct access to local secret files in an agent workflow. In a tool-enabled environment, encouraging file-based credential handling increases the chance of secret disclosure, accidental logging, broader-than-needed file access, or misuse by adjacent scripts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [UpKuaJing Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file adds account lifecycle and billing-related capabilities such as API-key issuance, balance lookup, recharge ordering, and pricing retrieval that are outside the declared Google Maps merchant-search purpose. Scope expansion is dangerous because it introduces financial-account and credential-management behavior that users and reviewers would not expect from a lead-generation skill, increasing the chance of unauthorized account actions or hidden monetization flows.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 64)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 86)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 91)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The code opens and reads the local .env file to inspect an existing API key, which is a form of credential access beyond the stated merchant-search purpose. In context, this is concerning because the skill is not merely using an already-provided secret for API access; it is actively managing and inspecting local credential material, increasing secret exposure risk.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This line writes a freshly issued API key into a plaintext .env file, creating persistent local credential material. Plaintext secret storage is dangerous because other local processes, backups, logs, or users may access the file, leading to credential compromise and unauthorized API use.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly requires an environment variable and instructs reading and writing local files such as ~/.upkuajing/.env, while also invoking remote APIs, but it declares no explicit tool scope or permission boundaries. In an agent environment, this increases the risk of overbroad file, credential, and network access being granted implicitly without clear user or platform review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrases are broad and overlap with ordinary business and research requests, which can cause the skill to activate unexpectedly. Because this skill can perform paid queries, handle API keys, and collect bulk merchant contact data, accidental invocation has financial, privacy, and data-governance consequences beyond simple UX confusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly allows sending request parameters, response data, and exception context to an external error-reporting API. Although it notes that sensitive fields are 'automatically desensitized,' it does not define what is redacted, require data minimization, or warn operators not to include user/merchant personal data, tokens, or proprietary business content in those fields. In a lead-generation and merchant-scraping skill, those payloads can easily contain contact details, queries, and internal business data, creating a meaningful privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code provisions a new platform API key and stores it locally, which goes beyond the advertised merchant-search functionality and introduces credential-generation and secret-handling behavior. This is dangerous because the skill can create persistent credentials on behalf of the user and write them to disk, expanding attack surface for credential misuse, accidental disclosure, and unauthorized API consumption.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using require_auth=False for the key-creation endpoint establishes an unsafe default where a sensitive operation proceeds without authentication in the client workflow. In a skill already exceeding its declared merchant-search scope, this makes the behavior more dangerous because it automates credential provisioning with minimal friction and little user scrutiny.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using require_auth=False for the key-creation endpoint establishes an unsafe default where a sensitive operation proceeds without authentication in the client workflow. In a skill already exceeding its declared merchant-search scope, this makes the behavior more dangerous because it automates credential provisioning with minimal friction and little user scrutiny.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes a newly issued API key directly to the local .env file without an interactive warning, confirmation, or visibility into overwrite side effects. Silent secret creation and file modification are risky because they can unexpectedly change local authentication state, persist sensitive material in plaintext, and create credentials the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script exposes functions to create recharge orders and query pricing, which are not necessary for merchant discovery and can trigger or facilitate financial transactions on the associated platform. In the context of a Google Maps scraping skill, these capabilities increase risk because they enable billing actions unrelated to the user’s expected task and could be abused for unwanted charges or social-engineering around payments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The helper sends arbitrary request parameters to an external API endpoint, but this file provides no disclosure, consent mechanism, or data classification guard before transmitting potentially sensitive merchant-search inputs. In a lead-generation and scraping skill, those parameters may include user-supplied business targets, locations, and contact-related query data, creating a privacy and transparency risk even if the transport uses HTTPS.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code and docstrings state that this script reports Agent/Skill exceptions to a platform endpoint and returns a report ID. That behavior does not match the manifest's described functionality of scraping Google Maps businesses, filtering by radius, and analyzing merchants for offline expansion.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:117