ClawHub
Back to skill

Security audit

查询分析报告-区域分布 — 按国家/地区维度分析指定HS编码的贸易区域分布数据，支持出口国/进口国类型筛选和最近月数筛选。返回每个国家的贸易次数、贸易金额、采购商数量和供应商数量等关键指标，帮助贸易分析师、市场研究人员和进出口从业者了解产品在全球各国的贸易分布情况、比较出口国与进口国的贸易活跃度、识别重点目标市场——覆盖全球220多个国家和地区的海关贸易数据，是区域市场分析和贸易地理分布研究的核心工具。

Security checks for vulnerabilities and agentic risk

Overview

This paid trade-data skill mostly does what it says, but it handles API credentials and billing-related actions in ways users should review carefully before installing.

Install only if you are comfortable giving this skill access to a paid Upkuajing API account. Do not run the documented cat command on the .env file in an agent session, because it can expose the API key. Review the recharge/account commands before use, confirm any paid query separately, and consider storing the key with stricter local permissions or a secret manager.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:73
Finding

API Key Exposure Through Documentation and Insecure Local File Creation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Version

Content
View full analysis
=0.23.0 ``` The documented installation command in `SKILL.md:18` is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement specifies only a minimum version and has no upper bound, exact version, lock file, or integrity hash. Consequently, installations performed at different times may resolve to different and unaudited versions of `httpx` and its transitive dependencies. Package installation may execute package build or installation logic. If a future release or one of its dependencies is compromised, an installation following the Skill's instructions could introduce malicious code. Even without a compromise, an incompatible future release could change TLS, proxy, redirect, timeout, or request behavior and undermine the assumptions made during this audit. The dependency name is legitimate and no current malicious package was identified. The risk arises from unrestricted future resolution rather than confirmed malicious behavior in the named package. ### Attack Path 1. An attacker compromises a future allowed release of `httpx` or one of its resolved transitive dependencies. 2. A user later follows the Skill instructions and runs `pip install -r requirements.txt`. 3. The package resolver selects the compromised version because it satisfies `httpx>=0.23.0`. 4. Malicious installation or runtime code executes with the permissions of the user running `pip`. 5. The malicious dependency could access files and environment variables available to that process, including `UPKUAJING_API_KEY`, or tamper with API requests and responses. ### Impact Assessment A compromised dependency could execute code with the installing user's privileges. Potential exposure includes the API key, local user fil ...[truncated 298 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (40)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Version checking, cache/metadata access, outbound requests to a version endpoint, and upgrade notices are outside the narrow scope of the stated analytics function. These hidden auxiliary behaviors increase network and filesystem exposure and can create unanticipated data leakage or supply-chain style risks if users believe the skill only performs local parameterized analysis queries.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Version checking, cache/metadata access, outbound requests to a version endpoint, and upgrade notices are outside the narrow scope of the stated analytics function. These hidden auxiliary behaviors increase network and filesystem exposure and can create unanticipated data leakage or supply-chain style risks if users believe the skill only performs local parameterized analysis queries.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Version checking, cache/metadata access, outbound requests to a version endpoint, and upgrade notices are outside the narrow scope of the stated analytics function. These hidden auxiliary behaviors increase network and filesystem exposure and can create unanticipated data leakage or supply-chain style risks if users believe the skill only performs local parameterized analysis queries.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Version checking, cache/metadata access, outbound requests to a version endpoint, and upgrade notices are outside the narrow scope of the stated analytics function. These hidden auxiliary behaviors increase network and filesystem exposure and can create unanticipated data leakage or supply-chain style risks if users believe the skill only performs local parameterized analysis queries.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly instructs reading the local file containing API credentials using a shell command. Direct access to ~/.upkuajing/.env exposes secrets unnecessarily and increases the risk that the agent, logs, or user-facing output could reveal the API key.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The workflow directs checking for a secret in a local .env file and describes paths for providing or automatically storing the API key there. This normalizes agent interaction with credential files and risks exposing, overwriting, or mishandling secrets in a context where the skill is supposed to perform analytics, not credential management.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Automatically saving newly issued API keys into ~/.upkuajing/.env and instructing manual edits creates persistent local secret handling in a skill that also performs network actions. In the absence of strict permission boundaries, this increases the chance of credential theft, accidental disclosure, or cross-skill abuse of stored secrets.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script exposes authentication lifecycle and billing operations in a skill advertised only for regional trade-distribution queries. This mismatch expands the skill's effective privilege and attack surface, enabling key issuance, account inspection, and payment initiation that a user would not reasonably expect from the declared functionality.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

Reading an existing .env file to inspect API key contents means the skill handles local credentials directly. In the context of a data-analysis skill, this is overbroad secret access and increases the risk of credential disclosure, misuse, or accidental propagation in logs and outputs.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

Writing a freshly issued API key into a plain-text .env file stores sensitive credentials in a location commonly readable by local tools, backups, and accidental uploads. This makes credential compromise much more likely, especially because the skill context does not justify local secret persistence as part of a regional-analysis feature.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

Returning the environment file path in error output reveals where credentials are or will be stored, aiding local discovery of secrets by other components or users. This is not as severe as exposing the key itself, but it increases the exploitability of the insecure storage design.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Creating recharge/payment orders is unrelated to HS-code regional analysis and introduces a financial-operation capability into a data-query skill. If triggered unexpectedly or chained by an agent, it could initiate unwanted purchase flows or social-engineer users into funding an account.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares broad capabilities involving environment access, filesystem access, and network activity without an explicit tool-scope or permission boundary. That creates unnecessary privilege ambiguity: a caller may invoke what appears to be a narrow trade-analysis skill, while the implementation can also read local secrets, write files, and make outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description lists trigger phrases such as “各国贸易” and “区域分析,” which are relatively broad and could overlap with many general commerce or analytics requests rather than uniquely indicating this area-distribution skill. The file does not provide exclusion conditions or narrower activation constraints to distinguish when this skill should activate versus related customs-analysis skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly allows sending requestParams, responseData, and exception context to a remote error-reporting endpoint, but it does not clearly warn users that these fields may contain sensitive business data, identifiers, or stack traces leaving the local execution environment. In a skill-handling context, failures often occur precisely when unexpected data is present, which increases the chance that confidential inputs or internal system details are included in telemetry and exposed beyond the original trust boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all user-facing CLI descriptions are written only in Chinese, which imposes a specific language on users without offering any language selection or opt-in. The policy explicitly calls out language or locale constraints as violations when no user choice is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code can request a new API key and persist it locally, which is a sensitive credential-management capability not proportional to the stated purpose of geographic trade analysis. Embedding credential provisioning in a broadly triggered skill increases the chance of silent key creation, mishandling, or later misuse by other local processes.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Account balance and pricing queries are outside the narrow business purpose of regional-distribution analysis and reveal operational and financial metadata. While less severe than key issuance or payment creation, this unnecessary capability broadens what the skill can enumerate about the user's account and platform usage.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196