Query trade area distribution analysis for HS codes — retrieve trade distribution data by country/region for a specified HS code, with exporter/importer type and recent months filters. Provides trade counts, amounts, buyer counts and seller counts per country for comprehensive geographic market analysis across global customs data covering 220+ countries and territories. Designed for trade analysts, market researchers and import-export professionals who need to understand which countries trade a specific product, analyze regional distribution patterns and compare exporter vs importer country activity for strategic market planning.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.3

Overview

This skill supports trade-data queries, but it needs Review because it handles local API credentials, paid account/top-up flows, and automatic network/cache behavior with limited safeguards.

Install only if you are comfortable giving the skill access to an UpKuaJing API key and using paid API calls. Avoid printing ~/.upkuajing/.env, confirm every fee or top-up step before it runs, and do not send diagnostic reports that include sensitive business data unless you have reviewed the payload.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior requires access to environment variables, local files under ~/.upkuajing, and remote network endpoints. This mismatch weakens transparency and reviewability, making it easier for users or platforms to underestimate the skill’s effective privileges and approve broader access than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a data-query tool, but it also performs credential provisioning, local secret storage, account/balance queries, recharge order creation, price queries, error-reporting callbacks, and version-check/network cache behaviors. This expands the operational and trust boundary significantly beyond the stated purpose, increasing the risk of unexpected data exposure, billing actions, and user deception.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The file implements authentication and API-key lifecycle management for an external platform, which is materially outside the stated skill purpose of HS-code regional trade analysis. Capability mismatch is dangerous because users and reviewers may grant this skill broader trust than warranted, while the code can create, store, and manage credentials unrelated to the advertised analytical function.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Recharge-order creation, account inspection, and pricing lookup are financial/account-management functions unrelated to a trade-area analysis skill. This expands the skill's operational scope into billing actions, increasing the risk of unauthorized purchases, account enumeration, or accidental financial operations under the guise of a data-analysis tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module performs outbound network access to a version API and writes state to disk even though the declared skill purpose is trade-area analysis. This expands the skill's behavior beyond user-expected functionality, creating a hidden telemetry/supply-chain interaction surface and enabling external contact on normal use without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill creates a persistent cache under the user's home directory to track update checks, which is unrelated to the stated trade-analysis function. Persistent local state can leak usage patterns, violate least-privilege expectations, and create unnecessary privacy and tampering surface for a skill that should be largely stateless.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly encourages sending request parameters, response data, and exception context to an error-reporting endpoint, but it does not clearly warn operators that these fields may still contain sensitive business data, identifiers, or user content despite an assertion that some fields are automatically desensitized. In a trade-analysis skill, failed requests and stack traces can easily include customer queries, HS codes, account metadata, or backend response details, creating a real risk of privacy leakage and excessive data collection into a secondary logging channel.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code forwards request metadata and free-form context to a remote endpoint without any visible consent, redaction, or sensitivity controls. If context or requestPath contains user data, prompts, identifiers, or internal details, this creates a privacy and data-exposure risk through silent telemetry.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 91% confidence
• Finding: The skill instructs reading and storing API credentials in ~/.upkuajing/.env, creating a direct path for secret access and persistence on disk. Even if intended for normal setup, a skill that can inspect or modify local credential files materially increases the risk of credential disclosure, misuse, or unauthorized account activity.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 90% confidence
• Finding: The workflow explicitly tells the agent to check for UPKUAJING_API_KEY in a local .env file and, if absent, to create and save a new key automatically. This combines credential discovery with credential creation and persistence, which broadens the attack surface and can enable unauthorized use of a user’s local environment or account context.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: The code writes a newly issued API key in plaintext to a .env file under the user's home directory. Plaintext secret storage increases the chance of credential disclosure through weak filesystem permissions, backups, logs, accidental commits, or other local compromise, and this is more concerning because the file belongs to a skill whose advertised purpose is unrelated to credential management.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower-bound only constraint (httpx>=0.23.0), which allows installation of any future version, including releases with breaking changes or newly introduced supply-chain risk. While not an immediate exploitable flaw by itself, unpinned dependencies reduce build reproducibility and can cause the skill to unexpectedly consume a vulnerable or incompatible package version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58