查询分析报告-区域分布 — 按国家/地区维度分析指定HS编码的贸易区域分布数据，支持出口国/进口国类型筛选和最近月数筛选。返回每个国家的贸易次数、贸易金额、采购商数量和供应商数量等关键指标，帮助贸易分析师、市场研究人员和进出口从业者了解产品在全球各国的贸易分布情况、比较出口国与进口国的贸易活跃度、识别重点目标市场——覆盖全球220多个国家和地区的海关贸易数据，是区域市场分析和贸易地理分布研究的核心工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:54 AM UTC
• Version: 1.0.3

Overview

This trade-data skill is mostly coherent, but it needs Review because it handles local API credentials, account/recharge actions, and an automatic version-check cache with incomplete scoping and disclosure.

Install only if you are comfortable with this skill storing a UPKUAJING API key in a plaintext file under your home directory and using it for account, pricing, and recharge-related API calls. Confirm every paid query or recharge step yourself, avoid pasting or displaying the API key, and review any error report content before allowing it to be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior includes reading environment-backed credentials, reading and writing files under ~/.upkuajing, and making network calls to external platform APIs. This creates a transparency and consent problem: an operator may invoke a seemingly simple data-query skill without realizing it can access local secrets, persist data, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is limited to trade area analysis, but the skill also performs credential provisioning, account inspection, recharge order creation, pricing lookup, error reporting, and version-check/cache behavior. This mismatch is dangerous because it hides higher-risk operations behind a low-risk analytical description, increasing the chance of unauthorized billing actions, credential handling, or unintended outbound data transfer.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements API key issuance, account lookup, pricing lookup, and recharge-order creation, which are materially unrelated to the stated purpose of an HS-code regional trade analysis skill. In an agent-skill context, bundling credential and billing operations expands the attack surface, creates opportunities for unauthorized account actions, and violates least-privilege expectations users would have for an analysis-only skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code contains unjustified credential-management and billing capabilities for a skill whose declared purpose is regional trade analysis. Such hidden or unnecessary financial/account features are dangerous because they can trigger account enumeration, key lifecycle changes, or payment-related actions from a context where users do not expect those capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The code performs an extra network call via check_and_notify(API_BASE_URL) before making the requested API call, which is not necessary for the stated regional analysis function. Hidden or undocumented outbound requests increase privacy and supply-chain risk because they create an additional trust boundary and may transmit execution metadata without user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This module adds outbound network behavior to contact a remote version-check endpoint, which is unrelated to the advertised customs regional analysis function. Even though the request appears limited to skill name/version metadata, hidden network capability expands the trust boundary, can leak usage information, and creates an unexpected remote dependency that could be abused for tracking or future command-and-control style behavior.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implements persistent local cache writes, daily check state, and upgrade notifications despite the skill being described as trade-region analysis. This mismatch is risky because undeclared side effects and persistence can conceal telemetry or operational behavior that users and reviewers would not expect from the stated purpose, reducing transparency and increasing the chance of abuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation encourages sending request parameters, response data, and exception context to an error-reporting API, while only briefly noting that some sensitive fields will be automatically masked. That is not a sufficient safeguard because these payloads can still contain credentials, personal data, business-sensitive content, or stack traces that should not be transmitted by default, creating a real risk of over-collection and secondary data exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The module can log full request parameters and full response bodies to local files, which may include sensitive trade queries, account data, or other returned information. Although logging is disabled by default, enabling it creates a clear data exposure risk because the logs are stored persistently without redaction, retention controls, or user warning.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script forwards request metadata and arbitrary runtime context to a remote endpoint via make_request('/agent/skill/error/report', params) after only checking that fields are present. Because the context field can contain exception details, request paths, IDs, or other operational data, this can leak sensitive information to the platform without minimization, redaction, or any explicit user-facing notice/consent.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs reading a local ~/.upkuajing/.env file to check for an API key and supports automatically saving new credentials there. Accessing and persisting secrets in a general-purpose local file increases the risk of credential exposure, accidental disclosure, insecure file permissions, or misuse by other tools on the host.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: This section continues the same credential-handling pattern by directing users to place API keys into ~/.upkuajing/.env and allowing auth.py to auto-save them locally. In the context of a trade-analysis skill, direct manipulation of local credential files is more dangerous because it exceeds normal query behavior and trains operators to handle secrets in an insecure, inspectable location.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 87% confidence
• Finding: The script writes a newly issued API key to a plain-text .env file under the user's home directory. Storing long-lived credentials in plaintext increases the chance of compromise through local file disclosure, backups, logs, or accidental inclusion in support bundles and source control.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.23.0), which allows installation of any newer version, including future releases that may introduce breaking changes or supply-chain risk. While this is not an immediate exploit by itself, it weakens build reproducibility and can expose the skill to vulnerable or unreviewed dependency versions over time.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: Using require_auth=False for credential issuance establishes an unsafe default because sensitive account bootstrapping is permitted without authentication. Given the skill's declared business purpose is trade-region analysis rather than account creation, this mismatch makes the behavior more suspicious and increases the danger of misuse.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: Using require_auth=False for credential issuance establishes an unsafe default because sensitive account bootstrapping is permitted without authentication. Given the skill's declared business purpose is trade-region analysis rather than account creation, this mismatch makes the behavior more suspicious and increases the danger of misuse.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196