Google Maps business data extraction paired with bulk search and batch data download capabilities for global B2B lead generation. Filter search results bycountry, state, city, district, search radius, industry and product keywords to batch collect business names, physical addresses and full contact details.Precisely pinpoint overseas buyers and local enterprises to streamline end-to-end lead development workflows. Support field sales reps, distributors, brandoperation teams and regional managers to target merchants in designated zones and commercial districts. Analyze regional market density and coverage data togenerate high-qualified sales prospects. Fully optimized for regional business expansion, new outlet setup, distributor recruitment, competitor locationtracking and territory planning for offline channel development.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:19 AM UTC
• Version: 1.0.6

Overview

This is a coherent paid UpKuaJing merchant-search API skill, but it stores an API key locally and includes billing, update-check, and user-confirmed error-reporting flows users should understand.

Install only if you are comfortable with a paid external API wrapper that stores UPKUAJING_API_KEY in a local plaintext .env file, writes search results to local task files, checks versions with UpKuaJing, and can send user-confirmed error reports. Confirm fees and top-up actions before proceeding, and do not include secrets or unnecessary personal data in error-report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly requires sensitive capabilities—environment access, reading and writing files under the user's home directory, and outbound network/API access—yet it does not declare corresponding permissions. This creates a transparency and consent gap: the agent may access credentials and write persistent config data without an explicit permission model, increasing the chance of unintended secret exposure or unauthorized external requests.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file implements API key issuance, account lookup, pricing, and recharge/payment workflows even though the skill is described as a Google Maps merchant-search scraper. This capability expansion is dangerous because it introduces account and billing operations unrelated to the stated purpose, increasing the attack surface and enabling unexpected monetization or credential-handling behavior inside a data-collection skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill can create recharge/payment orders, which is outside the expected scope of merchant searching and scraping. Even without direct automatic payment execution, generating payment URLs can steer users into financial flows they did not expect from this skill and creates unnecessary billing-related risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script contains telemetry behavior that reports runtime exceptions to a remote platform, including agent/skill invocation metadata, even though the skill’s stated purpose is Google Maps merchant search and lead gathering. This creates an undeclared data-flow channel that can leak operational details and potentially sensitive context outside the expected business function, especially if callers pass rich error context.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code explicitly requires and transmits requestId, requestPath, and context to a remote endpoint. Because context is free-form and request metadata may reveal internal workflow details, this can expose sensitive internal information or user-derived content to an external service without clear necessity for the advertised merchant-search capability.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This module introduces persistent local state under the user's home directory and performs outbound network requests to a remote version-check endpoint, behavior that is unrelated to the stated merchant-search functionality. While software update checks can be legitimate, embedding them inside a skill without clear user consent or tight scoping expands the skill's privacy and attack surface, especially because it executes automatically and reveals installed skill identity to an external service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly instructs agents to send request parameters, response payloads, and exception context to an error-reporting endpoint, but it does not require data minimization, consent, or a clear warning about sensitive-data handling. In a lead-generation and merchant-scraping skill, those fields may contain personal contact data, API outputs, internal prompts, or tokens, creating a meaningful risk of privacy leakage and over-collection through telemetry.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [UpKuaJing Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs checking for and manually storing an API key in a plaintext `~/.upkuajing/.env` file, which involves credential handling and local secret persistence. In the context of a skill that also uses file access and networked scripts, this raises the risk of secret disclosure, accidental overwrites, or prompting users to reveal credentials through the agent workflow.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 72% confidence
• Finding: The code writes a newly issued API key directly to a .env file in plaintext under the user's home directory. In the context of a merchant-search skill that already contains unexpected account/billing functionality, plaintext secret persistence increases the chance of credential exposure through local compromise, backups, accidental sharing, or other tooling that reads dotenv files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any newer httpx release, including breaking changes or versions that may introduce known or future vulnerabilities. In a skill focused on bulk scraping and external network access, dependency drift increases supply-chain risk and can lead to unstable or insecure behavior across environments.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:117