ClawHub
Back to skill

Security audit

支持国际短信批量群发 / 全球 SMS批量发送，提供营销短信和商务短信，支持双方回复，一键群发短信并通过即时任务追踪与送达报告监控每一条短信状态。帮助营销人员、销售团队、运营、客服向全球客户触达、追踪短信活动效果、驱动转化与回收——适合促销短信群发、订单/物流通知、客户批量外联与召回，适用于跨境电商、外贸出海与海外用户运营。

Security checks for vulnerabilities and agentic risk

Overview

This is a real SMS API skill, but it needs review because it stores API keys in a local plaintext file and performs some under-disclosed account, billing, and telemetry-related actions.

Install only if you trust Upkuajing with recipient phone numbers, SMS content, account data, and billing flows. Keep ~/.upkuajing/.env private, avoid enabling raw API logging unless you can protect and redact the logs, confirm before any paid SMS or recharge action, and do not include secrets or customer data in optional error reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation indicates capabilities to read environment variables, access local files such as ~/.upkuajing/.env, write credentials, and call external network APIs, but these capabilities are not explicitly declared as permissions in the manifest. This creates a transparency and policy gap: users and reviewers may not understand the actual access the skill requires, increasing the risk of unexpected credential handling or data exfiltration.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is presented as an SMS sending/status tool, but the documented behavior extends into API key issuance, account lookup, pricing retrieval, recharge order creation, and error reporting. This scope expansion increases attack surface and can enable actions involving billing, account management, and telemetry that users may not reasonably expect from the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill includes creation of recharge/payment orders and instructs the agent to handle a payment flow by sending a payment URL to the user. Payment initiation is materially more sensitive than ordinary SMS delivery, introducing financial risk and phishing-like interaction patterns if abused or triggered unexpectedly.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The skill handles phone numbers and message content for bulk cross-border SMS, but the documentation does not clearly warn about privacy, consent, regulatory, or personal-data handling risks. In this context, omission is significant because the tool is intended for outreach and logistics messaging, both of which can involve personal data and anti-spam compliance obligations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The document instructs agents to upload exception context, request parameters, and response data to a remote API, but it does not clearly warn that these fields may contain sensitive user, business, or authentication data. Although it mentions that sensitive fields are 'automatically desensitized', that claim is undefined and incomplete redaction can still leak personal data, tokens, message contents, or internal business information during error reporting.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The logging helpers can persist full request parameters and API responses to local files when ENABLE_API_LOGGING is enabled. In an SMS/marketing tool, those payloads may contain phone numbers, message content, delivery data, and possibly authentication-related metadata, creating a privacy and data-exposure risk if logs are later accessed by other local users, backup systems, or support tooling.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script sends the caller-provided `context` field, along with request metadata, to a remote `/agent/skill/error/report` endpoint without any disclosure, minimization, or sanitization visible in this file. In an error-reporting path, `context` may contain stack traces, request contents, identifiers, or other sensitive business/customer data, so automatic transmission can leak information beyond what operators expect.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The module automatically sends the skill name to a remote version-check API on first use each day, with no evidence in this file of user notice, consent, or an opt-out. Even though the payload is limited, it creates undisclosed outbound telemetry and reveals locally installed skill usage to a server, which is a privacy and trust concern in a security-sensitive agent environment.

Credential Access

High
Category
Privilege Escalation
Content
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
94% confidence
Finding
The skill instructs the agent to inspect a local secrets file (~/.upkuajing/.env) to determine whether an API key exists. Accessing secret-storage files is sensitive because it exposes credential presence and potentially the credential itself to the skill execution path; coupled with network capability, this materially raises credential theft or misuse risk.

Credential Access

High
Category
Privilege Escalation
Content
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
95% confidence
Finding
The documentation goes beyond checking for a key and states that the skill can apply for a new API key and automatically save it into ~/.upkuajing/.env. Automatic creation and storage of credentials in a local secrets file expands the skill into credential provisioning and persistence, increasing the risk of unauthorized account creation, credential leakage, or silent persistence of sensitive tokens.

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
91% confidence
Finding
The script writes a newly issued API key directly to a plaintext .env file under the user's home directory. If file permissions are too broad, backups/sync tools capture the file, or other local users/processes can read it, the API key can be stolen and then abused to access the SMS platform account and related functions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
92% confidence
Finding
The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including major releases with breaking changes or versions later found to be vulnerable. This weakens build reproducibility and can unintentionally introduce supply-chain risk if the environment resolves to an unsafe or incompatible release.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/sms_send.py:25

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/sms_task_list.py:28

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/sms_task_record_list.py:30