Global bulk business SMS and commercial marketing text messaging built for cross-border B2B outreach. Access full two-way reply features, one-click massdispatch, live task tracking and detailed delivery reports to monitor real-time SMS delivery status. Marketing, sales, operations and customer support teamsengage global audiences with seamless cross-border communication. Track full SMS campaign performance metrics to lift conversion rates and reactivate lapsedoverseas clients. Fully applicable for promotional blasts, logistics order notifications, B2B cold outreach and customer re-engagement. Perfectly matched forcross-border e-commerce operations, export business expansion and global overseas user management workflows.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.4

Overview

This SMS skill is not clearly malicious, but it needs review because it can send paid texts and stores or accepts its account key in risky ways.

Review before installing. Use this only for lawful, consent-based SMS workflows, avoid passing the API key on the command line, restrict permissions on ~/.upkuajing/.env if you use it, and be careful not to include phone numbers, message bodies, or secrets in error reports unless necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:60

Finding

API Key Stored Without Explicit Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/auth.py:20

Finding

Existing API Key Prefix Disclosed in Program Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sms_send.py:91

Finding

API Key Accepted Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded and Unhashed Third-Party Dependency

Content

View full analysis

=0.23.0 ``` The Skill instructs installation with: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency declaration permits any current or future `httpx` release at or above version 0.23.0. No upper bound, exact reviewed version, or package hash is supplied. As a result, installations performed at different times may resolve to different code. There is no evidence that `httpx` itself is malicious or that the package name is misspelled. The risk arises from allowing future releases to enter the execution environment without package-level review or integrity verification. This also increases the possibility of unexpected compatibility and behavioral changes. ### Attack Path 1. A user follows the Skill instructions and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest available version satisfying `>=0.23.0`. 3. A future compromised, malicious, or incompatible release could therefore be selected automatically. 4. Package installation or subsequent import executes code from that unreviewed release in the user's Python environment. 5. Such code would run with the privileges of the user executing the Skill and could access data available to that process, including the API credential. This path is conditional on a compromised or unsafe future dependency release; no such compromise was established during this audit. ### Impact Assessment The immediate confirmed impact is loss of reproducibility and review control. If the conditional supply-chain attack path materialized, the dependency would execute with the invoking user's local privileges and could potentially access: - The `UPKUAJING_API_KEY` environment variable. - The credential stored under `~/.upkuajing`. - ...[truncated 276 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs remote version checks, reads local metadata, writes a version cache, and emits upgrade notices, but those behaviors are not apparent from the top-level purpose statement. Undisclosed network and filesystem behaviors are security-relevant because they expand data exposure and persistence beyond user expectations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs reading and populating credentials from a local .env file and can automatically create and persist a new API key. Credential discovery, creation, and storage are sensitive operations; if the skill is over-permissioned or compromised, it could expose or misuse long-lived secrets for paid messaging and account actions.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the API (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This is the same credential-handling pattern in operational flow form: the skill checks for a local secret, asks the user to provide one, or automatically generates and saves one to disk. In context, that is particularly sensitive because the key authorizes chargeable SMS activity and related account operations, making credential theft or silent persistence materially harmful.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the API (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 64)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 86)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 91)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script writes a newly issued API key directly into a plaintext .env file under the user's home directory. Plaintext credential storage increases the risk of local disclosure through weak filesystem permissions, backups, accidental inclusion in support bundles, or other tools that automatically ingest .env files.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The error path reveals the exact environment variable name and file path used for API key storage, which lowers the barrier for local attackers or malicious software seeking credentials. Combined with plaintext .env storage, this makes credential discovery and harvesting easier.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares powerful capabilities through metadata and instructions—network access, environment-variable access, and local file reads/writes—without an explicit tool-scope or permission boundary. That makes it harder for reviewers and runtime policy to constrain what the skill may do, increasing the risk of overbroad access to local secrets and unintended outbound actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Broad trigger phrases increase the chance that the skill activates in contexts where the user did not intend to invoke a mass-messaging tool. In a messaging skill with billing, credential use, and outbound communication, accidental activation can lead to privacy issues, unwanted costs, or inappropriate message sending workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill handles phone numbers, message content, delivery status, and potentially two-way replies, but the description lacks privacy, consent, and regulatory warnings. In the SMS context, this is more dangerous because telecom marketing often implicates personal data, anti-spam rules, opt-in/opt-out obligations, and cross-border compliance requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs agents to send request parameters, response payloads, and exception context to an error-reporting endpoint, which can easily include personal data, credentials, message content, phone numbers, or other sensitive operational data. Although it states that sensitive fields are 'automatically desensitized,' it does not define the scope, guarantees, or limits of that masking, and it provides no explicit warning to minimize or avoid sending sensitive content in free-form fields such as context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation describes bulk SMS sending, recipient phone number handling, message content, and delivery/reporting data without any notice about privacy, consent, lawful basis, opt-out handling, or misuse risks. In a mass-texting and cross-border outreach context, this omission increases the chance of unauthorized messaging, personal data misuse, and noncompliant processing of telecom and marketing data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes an SMS campaign tool focused on sending bulk SMS, handling two-way replies, and monitoring delivery reports. This file is dedicated to account/auth management and payments ('API 密钥申请、充值等功能'), which are operational account capabilities not described in the stated skill behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module title and description are written only in Chinese, and the CLI help/output throughout the file is likewise Chinese-only. This imposes a specific language on users without opt-in, which matches the language/locale policy violation category for natural-language content.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:197

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sms_send.py:25

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sms_task_list.py:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sms_task_record_list.py:30

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:118