UpKuaJing Company and People Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.6

Overview

This is a disclosed company and people lookup skill, but it handles API keys and personal contact results in unsafe, under-scoped ways that warrant review before installation.

Review this carefully before installing. Do not let the agent print `~/.upkuajing/.env`; provide the API key through a safer secret mechanism where possible. Expect searches and identifiers to be sent to UpKuaJing, expect paid API usage after confirmation, and treat returned people/contact data as regulated personal data. Use an isolated environment, restrict permissions on `~/.upkuajing` and any `task_data` files, and delete retained results when no longer needed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:66

Finding

Credential Disclosure Through Documented Secret-File Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:66-75
Vulnerability Type: Unnecessary exposure of an API credential
Risk Level: High

markdown

This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text

UPKUAJING_API_KEY=your_api_key_here

API Key Not Set

First check if the ~/.upkuajing/.env file has UPKUAJING_API_KEY;

text

### Technical Analysis

The Skill explicitly instructs the agent to execute `cat ~/.upkuajing/.env`. This prints the complete plaintext contents of a credential file into command output. In an agent environment, command output may be copied into model context, conversation transcripts, execution logs, monitoring systems, or debugging records.

The declared functionality only requires determining whether `UPKUAJING_API_KEY` exists and allowing the scripts to use it for authenticated requests. Neither task requires revealing the key. Reading and displaying the entire file therefore exceeds the minimum privilege necessary for the Skill.

The command also exposes every other variable that may be present in the file, not only the UpKuaJing key.

### Attack Path

1. A user invokes the Skill without explicitly supplying an API key.
2. The agent follows the documented setup procedure.
3. The agent executes `cat ~/.upkuajing/.env`.
4. The complete API key and any other file contents enter the tool output and agent transcript.
5. A party with access to transcripts, logs, shared session output, or monitoring data obtains the credential.
6. The exposed key can be reused against authenticated UpKuaJing endpoints until it is revoked.

### Impact Assessment

Exposure grants the attacker the same API privileges as the affected key. This may include access to account information, company and personal-data searches, contact-information retrieval, payment-order creation, and consumption
...[truncated 198 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to run cat ~/.upkuajing/.env.
• Prefer injecting UPKUAJING_API_KEY directly through the execution environment.
• If presence must be checked, use a helper that emits only a boolean result and never the value.
• Restrict any file check to the exact expected variable rather than reading or displaying the entire file.
• Add explicit guidance that API keys must never be printed in tool output, logs, errors, or conversational responses.
• Revoke and rotate any key that has already appeared in execution transcripts.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auth.py:63

Finding

API Key Written Without Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py:63-74
Vulnerability Type: Insecure plaintext credential storage
Risk Level: High

python

UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)

with open(env_file, 'w', encoding='utf-8') as f:
    f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

A newly issued API key is written in plaintext to ~/.upkuajing/.env. The code does not assign restrictive permissions to either the parent directory or the credential file.

The resulting access mode depends on the process umask. Under commonly used settings, the directory may be created as 0755 and the file as 0644, making the secret readable by other local users. The implementation also does not inspect or repair permissions when the directory or file already exists.

Opening the predictable path with ordinary open(..., 'w') also lacks explicit protection against symbolic links. In an environment where another principal can manipulate the path, this can redirect the credential write to an unintended target.

Attack Path

1. The user runs python scripts/auth.py --new_key.
2. The service returns a new API key.
3. The script creates ~/.upkuajing and writes .env using umask-derived permissions.
4. Another local user or process reads the plaintext file if permissions permit.
5. The attacker extracts UPKUAJING_API_KEY.
6. The attacker submits authenticated requests and consumes the account's privileges or balance.

A symlink-based variation is possible if an attacker can prepare or replace the expected path before the write.

Impact Assessment

A successful exploit exposes the full API credential and grants access equivalent to the legitimate user. Potential consequences include paid API consumption, access to account-backed search data, retrieval of personal contact information, and creation of payment URLs or orders.

This issue does not grant general root or operating- ...[truncated 118 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700.
• Create the credential file atomically with mode 0600, such as by using os.open with O_CREAT, O_EXCL, and an explicit mode.
• Explicitly inspect and correct permissions on existing directories and files.
• Reject symbolic links and verify that the resolved file remains inside the intended directory.
• Prefer an operating-system credential store or secret-management service instead of a plaintext .env file.
• Avoid returning or logging any part of the existing key, including the current ten-character prefix.
• Provide a credential-rotation procedure in case local disclosure is suspected.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned dependency and non-reproducible installation
Risk Level: Medium

text

httpx>=0.23.0

The Skill instructs installation using:

bash

pip install -r requirements.txt

Technical Analysis

The dependency declaration accepts every httpx version from 0.23.0 onward. It has no exact version pin, upper bound, integrity hash, or trusted-index enforcement.

Consequently, different installations can resolve to different package versions. A future compromised release, malicious package-index substitution, or incompatible update could be installed without any change to the audited Skill package. Python package installation can execute package build logic, and imported dependency code executes with the privileges of the agent process.

No evidence was found that the current httpx package is malicious. The confirmed issue is that dependency resolution is not constrained or reproducible.

Attack Path

1. A user follows the Skill instructions and invokes pip install -r requirements.txt.
2. pip resolves the newest matching package from its configured index.
3. A compromised future release or attacker-controlled package source supplies malicious installation or runtime code.
4. The package executes during installation or when imported by the scripts.
5. The malicious code inherits access to the agent process, local files, environment variables, and the UpKuaJing API credential.

Impact Assessment

Successful supply-chain exploitation could execute arbitrary Python code with the privileges of the user running the Skill. This could expose local data and environment variables, including UPKUAJING_API_KEY, modify files accessible to the process, or issue unauthorized network requests.

The operating-system scope is limited by the privileges of the installation and execution account, but the impact may ...[truncated 77 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specifically reviewed version.
• Generate a lock file containing transitive dependency versions.
• Add cryptographic hashes and install with pip --require-hashes.
• Use an explicitly configured trusted package index or internal artifact repository.
• Install dependencies inside an isolated virtual environment without administrator privileges.
• Review and test dependency updates before changing the lock file.
• Add automated vulnerability and provenance scanning to the dependency-update process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/common.py:480

Finding

Sensitive Search Results Persisted Without Explicit Access Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/common.py:480-482
Vulnerability Type: Insecure local storage of personal and business data
Risk Level: Medium

python

with open(result_file, 'a', encoding='utf-8') as f:
    for item in data_list:
        f.write(json.dumps(item, ensure_ascii=False) + '\n')

Related task metadata is also written without an explicit access mode:

python

with open(meta_file, 'w', encoding='utf-8') as f:
    json.dump(meta, f, ensure_ascii=False, indent=2)

Technical Analysis

Company and people search results are appended to plaintext JSONL files under the Skill's task_data directory. File permissions are inherited from the process umask rather than being explicitly restricted.

Search records can contain company information and personal or professional information. The contact endpoint prints contact data rather than storing it through this helper, but people-list results and query metadata can still constitute sensitive data.

The implementation provides no retention period, cleanup operation, encryption option, or data-minimization control. Stored metadata also includes search parameters and API cursors. This creates a persistent local data set whose lifetime can exceed the original task.

Attack Path

1. A user performs a company or people list search.
2. The script creates a task identifier and receives records from the remote API.
3. append_result_data writes the records to a predictable project-local task_data hierarchy.
4. The files receive umask-derived permissions and remain after the command completes.
5. Another local account, shared workspace user, backup consumer, or later process reads the retained files.
6. The reader obtains the stored personal, professional, business, and query information.

Impact Assessment

Exploitation can disclose all records stored for affected search tasks, along with search criteria and paginati ...[truncated 395 chars]

Remediation

View remediation

Remediation Suggestions

• Create the task_data directory and each task subdirectory with mode 0700.
• Create result and metadata files with mode 0600, using atomic and symlink-resistant file operations.
• Correct insecure permissions on existing task files before reading or appending to them.
• Ask for user consent before persisting search results when persistence is not essential.
• Minimize stored fields and avoid retaining unnecessary personal data.
• Add configurable retention limits and an explicit secure cleanup command.
• Consider encryption at rest when results must persist in shared or managed environments.
• Document where records are stored, how long they remain, and how users can delete them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description does not disclose version-checking behavior, outbound calls to a version endpoint, or persistence of a local cache file under ~/.upkuajing/version_cache.json. Undisclosed network beacons and local persistence are risky because they expand data exposure and filesystem side effects beyond the user-expected search workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description does not disclose version-checking behavior, outbound calls to a version endpoint, or persistence of a local cache file under ~/.upkuajing/version_cache.json. Undisclosed network beacons and local persistence are risky because they expand data exposure and filesystem side effects beyond the user-expected search workflow.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs reading ~/.upkuajing/.env, which contains an API key, via cat, directly encouraging access to local credential material. Even if intended for setup, exposing or handling raw secrets in a general-purpose skill increases the risk of accidental disclosure in logs, transcripts, or downstream tool output.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill directs the workflow around checking and populating ~/.upkuajing/.env with UPKUAJING_API_KEY, including manual editing and automatic local storage. This is dangerous because it normalizes plaintext secret storage in a predictable location, making credential theft easier for other local processes, misconfigured permissions, or accidental exposure.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Automatically saving newly created API keys into ~/.upkuajing/.env creates persistent local credentials without discussing protections such as file permissions, encryption, or safe rotation. In the context of a skill that also performs network and billing operations, compromise of that key could enable unauthorized data access and chargeable API usage.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script writes a newly issued API key to a plaintext .env file under a user directory without showing any permission hardening or secure secret storage. If the file is readable by other local users, backed up insecurely, or accidentally exposed, the API key can be stolen and used to access paid account functions and sensitive people/company data.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

On save failure, the script instructs the user to manually set the API key as an environment variable, which can lead to insecure operational practices such as shell history leakage or process-environment exposure. This is weaker than secure storage and increases the chance of accidental credential disclosure.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares executable behaviors involving environment access, filesystem reads/writes, and network activity, but does not declare an explicit tool scope or permissions boundary. This creates a transparency and least-privilege problem: operators and users cannot easily assess what the skill is allowed to do, increasing the chance of overbroad execution and misuse of local credentials or files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L206 states that product names and industry names must be in English, which is a language constraint expressed in natural language. The file does not offer the user a language choice or explain a justified compliance or region-specific reason for forcing English input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly exposes availability of employee contact data via fields like person_contact_show and multiple contact-count filters, but provides no privacy, consent, lawful-use, or data-handling restrictions. In a skill marketed for customer development, background checks, and talent search, this increases the likelihood of misuse for scraping, unsolicited outreach, profiling, or privacy-law violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file is written entirely in Chinese, including the title and parameter descriptions, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly supports filtering people by the existence of phone, email, and WhatsApp contact data without any privacy, consent, or lawful-use constraints. In a skill marketed for customer development, background checks, and talent search, this materially enables targeted discovery of reachable individuals and increases the risk of privacy abuse, profiling, and non-compliant personal data processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The response schema reveals counts for phone, email, social, website, and WhatsApp data tied to individual people records, but provides no warning that these fields reflect potentially sensitive personal data. Even exposing presence/quantity metadata can facilitate lead scoring, deanonymization, and selective targeting of individuals, especially when combined with names, employer, role, and country.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code sends request parameters to a remote API via HTTP and may include sensitive business data in params, while also reading an API key for authorization. Although there are developer-facing docstrings, there is no user-facing print, prompt, or explicit disclosure at the point of transmission to inform the user that data is being sent off-system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language strings in the module docstring, argument help, and CLI description are Chinese-only. Per the policy, forcing a specific language without user opt-in can be a language/locale policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module title, description, CLI help text, and user-facing messages are presented exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends company/person identifiers to an external API endpoint to retrieve contact details such as email, phone, and WhatsApp, but provides no user-facing notice, consent flow, or sensitivity warning. Because the skill is explicitly designed to obtain personal contact data, this increases privacy and compliance risk if users submit identifiers without understanding that regulated personal data is being queried and transmitted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.