Publish Hsciq Mcp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:43 AM UTC
• Version: 3.0.1

Overview

This skill mostly does what it says, but it can send your API key and uploaded product data to a configurable server without enough safeguards.

Review this before installing. Use it only with product details, images, and QQ/WeChat contact data you are authorized to send to HSCIQ and human reviewers. Keep the API base URL pinned to the official HTTPS HSCIQ host, avoid running the JavaScript client from untrusted directories, and protect the HSCIQ API key because the current clients do not prevent credential forwarding to a misconfigured endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: hsciq-client.js:73

Finding

Unrestricted API Base URL Can Expose Credentials and Submitted Data in the JavaScript Client

Content

View full analysis

{ const [key, value] = line.split('='); if (key === 'HSCIQ_API_KEY') CONFIG.apiKey = value?.trim(); else if (key === 'HSCIQ_BASE_URL') CONFIG.baseUrl = value?.trim(); }); if (CONFIG.apiKey) return; } } if (process.env.HSCIQ_API_KEY) { CONFIG.apiKey = process.env.HSCIQ_API_KEY; CONFIG.baseUrl = process.env.HSCIQ_BASE_URL || 'https://www.hsciq.com'; return; } } ``` ```javascript async function rpcCall(method, params = {}) { const url = `${CONFIG.baseUrl}${CONFIG.endpoints.rpc}`; const response = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Accept': 'application/json, text/event-stream', 'X-API-Key': CONFIG.apiKey }, body ...[truncated 2709 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: hsciq_client.py:73

Finding

Unrestricted API Base URL Can Expose Credentials and Submitted Data in the Python Client

Content

View full analysis

Dict[str, Any]: """Standard MCP JSON-RPC call.""" url = f"{self.base_url}/mcp/rpc" self._request_id += 1 headers = { "Content-Type": "application/json", "Accept": "application/json, text/event-stream", } if self.api_key: headers[self.auth_header] = self.api_key payload = {"jsonrpc": "2.0", "id": self._request_id, "method": method, "params": params} data = json.dumps(payload).encode('utf-8') req = urllib.request.Request(url, data=data, headers=headers, method='POST') try: with urllib.request.urlopen(req, timeout=30) as response: body = response.read().decode('utf-8') ``` ```python parser.add_argument('--base-url', type=str, help='API base URL') ``` ```python client = HSCIQClient(base_url=args.base_url, api_key=args.api_key) ``` ### Technical Analysis The Python client permits the API destination to be selected through the `--base-url` command-line option, the `HSCIQ_BASE_URL` environment variable, or the configuration file. It performs no scheme, hostname, port, or destination validation before transmitting requests. The client independently resolves the API key from a command-line argument, environment variable, or configuration f ...[truncated 2380 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · hsciq-client.js (reported line 255)May include surrounding context.

js

console.log('  list-my-guilei-forms [--pageIndex 1] [--pageSize 20]');
        console.log('  add-guilei-dialog-message --formId <guid> --fieldKey <key> --content <text> [--dialogId <guid>]');
        console.log('  list-guilei-categories  (list industry categories for create-guilei-form categoryId)');
        console.log('  list-tools            (list available MCP tools via tools/list)');
        process.exit(0);
    }
    console.log(JSON.stringify(result, null, 2));

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly states that the skill submits product information and at least one product image to a remote HSCIQ service for AI processing and human expert review, but it does not provide any privacy, confidentiality, retention, or third-party data-sharing warning to users. In a customs/classification workflow, uploaded materials may contain sensitive commercial data, labels, supplier details, or regulated product information, so the lack of disclosure increases the risk of unintended sensitive-data exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares network, file-read, and environment-variable usage but does not define an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and can let the hosting agent invoke broader capabilities than users may reasonably expect, especially because the skill also handles API keys and local image files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: hsciq-mcp
description: HS Code Lookup for Chinese Products. Query customs codes, tariff rates, declaration elements, and regulatory requirements via HSCIQ MCP API. Create classification consultation requests with image upload for expert review.
license: MIT
tags:
  - HS Code Lookup for Chinese Products

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill supports submitting product details and images to an external expert-review service, but the description and trigger flow do not require a prominent user warning or explicit consent immediately before upload. This can cause unintended exfiltration of potentially sensitive commercial data, product imagery, or proprietary information to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The createGuileiForm path reads local image files, base64-encodes them, and sends them via callTool to the remote HSCIQ service. While this is part of the feature's implementation, there is no confirmation prompt, warning, or user-facing notice in this file that local file contents and provided product data will be uploaded off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The create_guilei_form function collects product details, contact information, and local image files, base64-encodes them, and transmits them to a remote endpoint. Although this is the intended functionality, the client provides no explicit runtime warning, consent prompt, or clear notice at the point of upload, which increases the risk of accidental disclosure of sensitive business information or personal data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The error output is hard-coded in Chinese, which imposes a specific language choice on all users of the skill. There is no indication of locale selection, opt-in, or justification that this tool is intentionally restricted to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language strings in the top-level module description are predominantly Chinese, including the feature list and usage context, without offering any language choice or stating that the tool is region-specific. Under the policy, forcing a specific language without opt-in is a language/locale policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: hsciq-client.js:10