Customs Trade Compliance

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:03 AM UTC
• Version: 1.0.0

Overview

This skill is a customs and trade compliance reference skill with proportionate guidance, though users should treat its legal/regulatory advice as something to verify before acting.

Installers should understand this is domain guidance, not a substitute for current legal advice. Verify tariff rates, sanctions lists, filing deadlines, and regulatory citations before relying on outputs, and avoid running the eval examples with API keys on the command line; use environment-based secret handling instead.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: evals/run_evals.py:6

Finding

API Key Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: evals/run_evals.py, lines 6–8
Vulnerability Type: API credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

python run_evals.py --api-key $ANTHROPIC_API_KEY
python run_evals.py --scenario CTC-001 --api-key $ANTHROPIC_API_KEY
python run_evals.py --verbose --api-key $ANTHROPIC_API_KEY

Technical Analysis

The documented commands instruct users to pass ANTHROPIC_API_KEY as a command-line argument. The shell expands the environment variable before starting Python, placing the plaintext credential in the process argument vector.

Depending on the operating system and deployment environment, process arguments may be accessible to other local users, process-monitoring utilities, CI/CD telemetry, container orchestration systems, diagnostic collectors, shell tracing, or error-reporting services. This creates an avoidable credential-disclosure channel even though the key originally resides in an environment variable.

Attack Path

1. A user exports a valid ANTHROPIC_API_KEY and runs one of the documented commands.
2. The shell expands $ANTHROPIC_API_KEY to its plaintext value.
3. The expanded key is included in the Python process argument vector.
4. A local observer, monitoring service, CI runner, or diagnostic collector captures the command-line arguments.
5. The exposed credential is reused to make unauthorized API requests.

Impact Assessment

An attacker who obtains the key may consume the associated API quota, incur charges, access API capabilities granted to the credential, and disrupt legitimate evaluations through rate-limit or budget exhaustion. The precise scope is limited by the permissions, spending limits, and account configuration associated with the exposed key. This issue does not directly provide operating-system privilege escalation.

Remediation

View remediation

Remediation Suggestions

• Remove --api-key $ANTHROPIC_API_KEY from all usage examples.
• Have the evaluation framework read ANTHROPIC_API_KEY directly from the environment without copying it into sys.argv.
• Prefer an operating-system or CI secret provider for automated execution.
• Ensure verbose output, exceptions, and telemetry redact authentication values.
• If interactive entry is necessary, use a non-echoing prompt such as Python's getpass rather than a command-line option.
• Rotate any key that may already have appeared in process telemetry or logs.
• Apply least-privilege permissions, spending limits, and usage alerts to evaluation credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · evals/results/baseline_results.json (reported line 709)May include surrounding context.

json

}
      ],
      "weighted_score": 0.85,
      "agent_response": "# UFLPA Detention Response Strategy\n\n## Immediate Actions (Days 1-3)\n\n### 1. Engage Legal and Trade Compliance Team\n- Retain specialized UFLPA counsel immediately\n- File formal acknowledgment of detention with CBP\n- Request detailed detention documentation and specific evidence CBP relied upon\n- Initiate communication with CBP Trade Remedy Law Enforcement Directorate (TRLED)\n\n### 2. Client and Stakeholder Management\n- Immediately notify retail client of detention and potential delays\n- Present timeline scenarios and mitigation options\n- Discuss cost-sharing arrangements for expedited response efforts\n- Begin sourcing alternative inventory if available\n\n## Evidence Collection Strategy (Days 1-15)\n\n### Primary Evidence Requirements\n\n#### **Tier 1: Garment Manufacturing (Dhaka Garments Ltd)**\n- **Factory certification and compliance records**\n  - WRAP, BSCI, or equivalent social compliance audits\n  - Factory registration and licensing documentation\n  - Employee records demonstrating fair labor practices\n\n#### **Tier 2: Fabric Supply Chain Mapping**\n- **Complete fabric supplier identification**\n  - Contracts with all fabric mills used for this specific order\n  - Purchase orders with fabric specifications and quantities\n  - Fabric mill certifications (OEKO-TEX, GOTS, etc.)\n  - Geographic mapping of fabric production facilities\n\n#### **Tier 3: Yarn Traceability**\n- **Yarn supplier documentation from fabric mills**\n  - Yarn purchase records with supplier names and locations\n  - Yarn composition certificates\n  - Supply chain declarations from yarn spinners\n  - Geographic verification of spinning facilities\n\n#### **Tier 4: Cotton Origin Verification**\n- **Cotton sourcing documentation**\n  - Cotton purchase contracts with origin specifications\n  - Certificates of origin for raw cotton\n  - Third-party supply chain audit reports\n  - Transactional records showing cotton
...[truncated 26 chars]

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The embedded response text includes a customer communication template that explicitly requires using English: "Please contact BIS directly regarding licensing requirements." This is a language/locale policy issue because the file prescribes a fixed language for external communication without offering user choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The agent response includes a supplier email template with the subject line and body addressed specifically to a Chinese supplier, e.g. 'For Your Chinese Supplier' and 'Subject: URGENT - Import Documentation Required - ETA 10 Days,' but does not offer any user choice about language or locale. Because this results file embeds natural-language skill outputs, the file contains content that assumes a fixed locale/context rather than explicitly offering a language/locale choice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/rubric.md (reported line 14)May include surrounding context.

md

| Rating | Score | Definition |
|---|---|---|
| **Pass** | 1.0 | Response demonstrates trade compliance expertise. The classification, valuation, and regulatory analysis are what an experienced customs specialist would provide. Correct legal and regulatory frameworks are cited. GRI application, FTA qualification analysis, penalty calculations, and screening adjudications are performed accurately. The response reflects operational judgment — not just regulatory knowledge but awareness of how customs authorities actually enforce, how brokers operate, and how trade compliance interacts with tax, procurement, and supply chain functions. |
| **Partial** | 0.5 | Response is directionally correct but incomplete or imprecise. The agent identifies the general category of trade compliance issue and suggests reasonable approaches, but misses critical regulatory details, applies thresholds or formulas incorrectly, omits a key step in the decision framework, or provides advice that is technically correct but would create problems in practice (e.g., filing a first sale claim without verifying the middleman's commercial role, or claiming USMCA preference without checking the exceptions list in the product-specific rule). |
| **Fail** | 0.0 | Response is incorrect, dangerously incomplete, or generic. The agent either misapplies the GRIs, applies the wrong legal framework (e.g., USMCA rules to an EU-UK TCA analysis), recommends actions that would increase penalty exposure or trigger regulatory violations, or provides advice so generic it could apply to any business function ("consult with legal and ensure compliance with applicable regulations"). A response that sounds plausible to a layperson but would make a trade compliance specialist wince. |

### Grading Decision Guide

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/scenarios.json (reported line 253)May include surrounding context.

json

| Rating | Score | Definition |
|---|---|---|
| **Pass** | 1.0 | Response demonstrates trade compliance expertise. The classification, valuation, and regulatory analysis are what an experienced customs specialist would provide. Correct legal and regulatory frameworks are cited. GRI application, FTA qualification analysis, penalty calculations, and screening adjudications are performed accurately. The response reflects operational judgment — not just regulatory knowledge but awareness of how customs authorities actually enforce, how brokers operate, and how trade compliance interacts with tax, procurement, and supply chain functions. |
| **Partial** | 0.5 | Response is directionally correct but incomplete or imprecise. The agent identifies the general category of trade compliance issue and suggests reasonable approaches, but misses critical regulatory details, applies thresholds or formulas incorrectly, omits a key step in the decision framework, or provides advice that is technically correct but would create problems in practice (e.g., filing a first sale claim without verifying the middleman's commercial role, or claiming USMCA preference without checking the exceptions list in the product-specific rule). |
| **Fail** | 0.0 | Response is incorrect, dangerously incomplete, or generic. The agent either misapplies the GRIs, applies the wrong legal framework (e.g., USMCA rules to an EU-UK TCA analysis), recommends actions that would increase penalty exposure or trigger regulatory violations, or provides advice so generic it could apply to any business function ("consult with legal and ensure compliance with applicable regulations"). A response that sounds plausible to a layperson but would make a trade compliance specialist wince. |

### Grading Decision Guide

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/scenarios.json (reported line 905)May include surrounding context.

json

| Rating | Score | Definition |
|---|---|---|
| **Pass** | 1.0 | Response demonstrates trade compliance expertise. The classification, valuation, and regulatory analysis are what an experienced customs specialist would provide. Correct legal and regulatory frameworks are cited. GRI application, FTA qualification analysis, penalty calculations, and screening adjudications are performed accurately. The response reflects operational judgment — not just regulatory knowledge but awareness of how customs authorities actually enforce, how brokers operate, and how trade compliance interacts with tax, procurement, and supply chain functions. |
| **Partial** | 0.5 | Response is directionally correct but incomplete or imprecise. The agent identifies the general category of trade compliance issue and suggests reasonable approaches, but misses critical regulatory details, applies thresholds or formulas incorrectly, omits a key step in the decision framework, or provides advice that is technically correct but would create problems in practice (e.g., filing a first sale claim without verifying the middleman's commercial role, or claiming USMCA preference without checking the exceptions list in the product-specific rule). |
| **Fail** | 0.0 | Response is incorrect, dangerously incomplete, or generic. The agent either misapplies the GRIs, applies the wrong legal framework (e.g., USMCA rules to an EU-UK TCA analysis), recommends actions that would increase penalty exposure or trigger regulatory violations, or provides advice so generic it could apply to any business function ("consult with legal and ensure compliance with applicable regulations"). A response that sounds plausible to a layperson but would make a trade compliance specialist wince. |

### Grading Decision Guide

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rubric requires listing importer data elements using British English terms such as "consignee number," but elsewhere in the file the scenarios are explicitly US customs focused. More directly, the file consistently forces UK spellings and terminology across all scenarios without offering any locale choice or documenting that this is intentional policy. This can violate a language/locale choice policy for natural-language content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · evals/scenarios.json (reported line 1020)May include surrounding context.

json

"weight": 0.35,
          "rubric": {
            "pass": "Analyses the substantial transformation question for steel: converting hot-rolled steel to cold-rolled steel involves cold reduction (reducing thickness by 25-90%), annealing, and temper rolling. CBP's position on steel processing has evolved — in early cases, cold-rolling was considered substantial transformation. But in recent EAPA cases (particularly involving Vietnam and other Southeast Asian countries), CBP has taken a narrower view, especially when: the only processing is cold-rolling without further manufacturing, the processing is performed on semi-finished steel specifically to avoid AD/CVD duties, and the processing country has no significant steel-making capacity. The $680/MT price is suspicious — it's below most legitimate Vietnamese cold-rolled production costs, suggesting the Chinese input steel is cheap (because it would otherwise face 265% duties) and the Vietnamese processing margin is minimal.",
            "fail": "Simplistically states 'cold-rolling is substantial transformation' without analysing the EAPA context. Does not consider the price analysis. Does not reference CBP's evolving position on steel processing cases."
          }
        },
        {

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/edge-cases.md (reported line 307)May include surrounding context.

md

- Total worst-case exposure: $6.3M+ plus seizure of in-transit goods

**Common Mistake:**
Blaming the supplier and hoping CBP doesn't notice. CBP holds the importer of record responsible for the accuracy of all entry information, including country of origin. "My supplier told me it was Malaysian" is not a defence — it is evidence of negligent reliance on a supplier without verification.

The second mistake: continuing to import while investigating. Every additional entry filed with the wrong origin adds to the penalty exposure.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · evals/results/baseline_results.json (reported line 485)May include surrounding context.

json

}
      ],
      "weighted_score": 0.35,
      "agent_response": "I'll analyze whether these e-bikes qualify for EU-UK TCA preferential treatment by examining the rules of origin requirements.\n\n## TCA Rules of Origin Analysis\n\n### 1. Applicable Rule of Origin\n\nFor HS 8711.60 (electric bicycles), the EU-UK TCA requires:\n- **Product-Specific Rule (PSR)**: Change of tariff classification to heading 87.11 from any other heading, except from headings 87.01 to 87.05, OR\n- **Alternative rule**: Non-originating materials do not exceed 45% of the ex-works price\n\n### 2. Component Analysis\n\nLet me assess both potential qualification routes:\n\n**Components breakdown:**\n- Chinese battery (HS 8507.60): 35% - Non-originating\n- Taiwanese motor (HS 8501.31): 20% - Non-originating  \n- German frame (HS 8714.91): 15% - EU originating\n- UK brakes/gears (HS 8714.93): 15% - UK originating\n- Japanese controller (HS 9032.89): 15% - Non-originating\n\n### 3. Rule Application\n\n**Route 1: Change of Tariff Classification**\n- All components are from different headings than 87.11\n- No components from prohibited headings 87.01-87.05\n- ✅ **This rule is satisfied**\n\n**Route 2: Value-based rule (45% threshold)**\n- Non-originating materials: 35% + 20% + 15% = 70%\n- This exceeds the 45% threshold\n- ❌ **This rule is not satisfied**\n\n### 4. Sufficient Processing Test\n\nThe assembly operations in Birmingham include:\n- Integration of battery packs with electrical systems\n- Installation of motors and controllers\n- Assembly of frames with mechanical components\n- Final testing and quality control\n\nThese operations go beyond simple assembly and constitute sufficient processing under TCA rules.\n\n### 5. Insufficient Processing Check\n\nThe operations are NOT limited to:\n- Simple packaging or preservation\n- Simple assembly without technical integration\n- Mere sorting or labeling\n\n✅ **Sufficient processing requirement is met**\n\n## Origin Qualification Result\n\n**✅ QUA
...[truncated 26 chars]

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L011 states that all templates assume U.S. jurisdiction unless otherwise noted, which sets a default locale/legal framework rather than asking the user to choose one. This could lead to policy issues where a specific jurisdiction is forced by default for users operating in other regions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.