查询分析报告-HS编码详情 — 获取指定HS编码的中英文描述信息，帮助贸易从业人员、分析师和进出口从业者了解特定HS编码所代表的具体产品类别。提供全面的产品分类信息，是HS编码查询、海关编码释义、产品分类验证和贸易数据分析准备的基础工具，适用于关税代码查詢、产品归类确认和海关数据分析前的准备工作。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its HS-code lookup purpose, but it handles API keys, payments, update checks, and error reports in ways users should review before installing.

Review this skill before installing. Use it only if you are comfortable with a paid API integration that stores an Upkuajing API key in `~/.upkuajing/.env`, can create recharge links, and can send error diagnostics to the platform after confirmation. Do not run commands that print the API key, and avoid approving error reports unless you can verify the payload contains no secrets or private business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:61

Finding

API Key Stored Without Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Documentation Instructs the Agent to Print the API Key File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/error_report.py:18

Finding

Error Reports Can Transmit Unredacted Sensitive Diagnostic Data

Content

View full analysis

dict: """ 上报 Agent 调用 Skill 异常。 Args: params: 上报参数（skillId, skillVersion, requestId, requestPath, context 等） Returns: 包含 reportId 的API响应 """ # 自动填充 skillId 与 skillVersion（外部显式传入时以外部为准） params.setdefault('skillId', get_skill_name()) params.setdefault('skillVersion', get_skill_version()) # 验证必要参数 for field in ('skillId', 'skillVersion', 'requestId', 'requestPath', 'context'): if not params.get(field): print(f"错误：params中缺少{field}", file=sys.stderr) sys.exit(1) response = make_request('/agent/skill/error/report', params) return response ``` The documented report schema also permits caller-supplied diagnostic objects: ```markdown | requestParams | object | No | Original request parameters | | responseData | object | No | Response content when the error occurred | | context | string | Yes | Exception context, stack trace, or error information | ``` ### Technical Analysis The report function forwards the caller-provided dictionary to the remote platform without client-side field allowlisting or recursive secret redaction. Diagnostic fields can contain API keys, authorization headers, cookies, personal data, proprietary request content, or unrelated conversation text. The Skill documentation requires user confirmation before reporting, which reduces unauthorized transmission. However, consent does not ensure that the user sees the exact payload or notices secrets embedded deeply in request parameters, response objects, or stack traces. Reliance on claimed server-side redaction is insufficient because the sensitive value has already left the local system before the se ...[truncated 956 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded and Unhashed Third-Party Dependency

Content

View full analysis

=0.23.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement sets only a minimum version and permits any future `httpx` release. It also supplies no package hashes or lock file. Consequently, the dependency resolved during installation can differ from the version reviewed during the audit. No evidence indicates that `httpx` is currently malicious, typosquatted, or fetched from an explicitly unsafe source. The risk is the absence of reproducible and integrity-verified dependency resolution: a compromised future release, incompatible update, or compromised package-index path could be installed automatically. ### Attack Path 1. A user installs the Skill’s dependencies at a later date. 2. The package resolver selects any available `httpx` version greater than or equal to `0.23.0`. 3. A future compromised or behaviorally incompatible release satisfies that range. 4. `pip` installs the selected package without checking a project-specified artifact hash. 5. The Skill imports and executes dependency code when its scripts run. ### Impact Assessment Python dependencies execute within the same operating-system account and process context as the Skill. A compromised dependency could read accessible files, environment variables, and the API key; make network requests; alter output; or execute local code. This is a conditional supply-chain risk rather than evidence of a presently compromised dependency. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version checking, reading skill files, writing cache data under the user's home directory, and emitting upgrade notices are unrelated to the advertised HS-code lookup purpose. These side behaviors create unnecessary filesystem and network activity, which increases privacy and integrity risk while reducing transparency about what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Version checking, reading skill files, writing cache data under the user's home directory, and emitting upgrade notices are unrelated to the advertised HS-code lookup purpose. These side behaviors create unnecessary filesystem and network activity, which increases privacy and integrity risk while reducing transparency about what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version checking, reading skill files, writing cache data under the user's home directory, and emitting upgrade notices are unrelated to the advertised HS-code lookup purpose. These side behaviors create unnecessary filesystem and network activity, which increases privacy and integrity risk while reducing transparency about what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version checking, reading skill files, writing cache data under the user's home directory, and emitting upgrade notices are unrelated to the advertised HS-code lookup purpose. These side behaviors create unnecessary filesystem and network activity, which increases privacy and integrity risk while reducing transparency about what the skill actually does.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly instructs reading the contents of ~/.upkuajing/.env with cat, which risks exposing the API key in plaintext to the agent output, logs, or downstream tooling. Credential display is unnecessary for normal operation and materially increases the chance of secret leakage.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The workflow instructs the agent to check for a key in a local .env file and potentially participate in adding or auto-saving a new API key there. This normalizes direct credential handling by the skill and increases risk of accidental disclosure, overwrite, or insecure storage of secrets on disk.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The instructions continue the same pattern of direct credential access and persistence in ~/.upkuajing/.env, including auto-saving newly issued keys. In the context of an agent skill advertised as a data lookup tool, this is more dangerous because users are unlikely to expect secret management behavior and may reveal or store credentials without informed consent.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script exposes account-management capabilities such as API key issuance, balance queries, recharge order creation, and pricing lookup that are unrelated to the declared HS-code detail lookup purpose. In a skill context, unjustified extra capabilities expand the attack surface and can enable unauthorized account actions or hidden monetization flows.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The function explicitly handles a local .env file for API key presence, indicating direct credential management in the skill code. Managing secrets through predictable flat files increases the chance of accidental disclosure, insecure permissions, or unintended reuse by other processes.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Reading the .env file to inspect existing API keys means the skill accesses persisted credentials directly. Direct parsing of local secret files is risky because it normalizes unsafe secret handling and can expose credentials through logs, errors, backups, or compromised local environments.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Writing the API key to a .env file stores a long-lived credential in a common plaintext location. Plaintext secret persistence materially raises the risk of credential theft from local users, malware, backups, source-control mistakes, or accidental file sharing.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code can create recharge/payment orders even though the skill is described only as an HS-code description lookup tool. Payment-related operations are highly sensitive because they can initiate financial workflows and may be abused for unauthorized charges, phishing-style redirection, or concealed commercial actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements remote error reporting, which is outside the stated purpose of an HS code detail lookup skill. Hidden auxiliary network behavior increases attack surface and can leak operational data in a context where users would reasonably expect only classification queries, making the mismatch security-relevant even if the code appears intended for telemetry.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares capabilities that include environment access, local file interaction, and network use, but it does not define any explicit tool scope or allowlist. That makes the effective privilege boundary unclear and increases the chance that an agent could invoke broader operations than users expect, especially around credential files and remote API actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description, headings, trigger phrases, and all usage examples are written exclusively in Chinese and frame the skill as operating in Chinese by default, despite the skill returning both Chinese and English descriptions. There is no stated option for the user to choose language or locale, which can violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document instructs agents to send request parameters, response data, and exception context to an error-report API, which can include sensitive business data, identifiers, or stack traces. Although it mentions automatic desensitization, it provides no explicit requirement to minimize data, obtain user/operator awareness, or prohibit secrets/PII in the payload, creating a realistic privacy and data-leakage risk during failure handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing descriptions are written only in Chinese, and the file provides no indication that another language can be selected or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script can request a new API key and persist it locally, which exceeds the minimal functionality needed for HS-code detail lookup. Credential provisioning inside a content-query skill is dangerous because it may silently bootstrap long-lived access for subsequent misuse or broaden access beyond the user's expectation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The explicit require_auth=False setting weakens the trust boundary around a sensitive operation that provisions API access. In the context of a simple lookup skill, unauthenticated key issuance is especially unjustified and increases the chance of silent credential bootstrap or backend abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The explicit require_auth=False setting weakens the trust boundary around a sensitive operation that provisions API access. In the context of a simple lookup skill, unauthenticated key issuance is especially unjustified and increases the chance of silent credential bootstrap or backend abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0: