ClawHub
Back to skill

Security audit

查询分析报告-HS编码详情 — 获取指定HS编码的中英文描述信息，帮助贸易从业人员、分析师和进出口从业者了解特定HS编码所代表的具体产品类别。提供全面的产品分类信息，是HS编码查询、海关编码释义、产品分类验证和贸易数据分析准备的基础工具，适用于关税代码查詢、产品归类确认和海关数据分析前的准备工作。

Security checks across malware telemetry and agentic risk

Overview

This skill is a paid HS-code lookup integration with disclosed API-key, account, and recharge helpers; it is not risk-free, but I did not find artifact-backed deception or malicious behavior.

Install only if you intend to use Upkuajing's paid API. Treat UPKUAJING_API_KEY as a secret, avoid pasting or displaying the .env contents in chat, confirm every paid query before execution, and review recharge/payment URLs before paying.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions, yet its documented behavior requires environment access, local file reads/writes, and network operations. This under-declaration is dangerous because it obscures the skill’s real trust boundary and can mislead operators or automated policy systems into allowing broader access than users expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The stated purpose is a simple HS-code description lookup, but the documented workflow also includes account creation, credential storage, account inspection, recharge order creation, pricing queries, and version/cache behavior. This mismatch is risky because users may invoke a low-risk informational skill while unknowingly granting a much broader set of sensitive and billable actions.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file implements API-key issuance, account lookup, recharge-order creation, and pricing retrieval, which materially exceed the declared purpose of an HS-code detail lookup skill. In a skill ecosystem, unrelated auth and billing capabilities enlarge the attack surface and can enable account misuse, unexpected network actions, and secret handling in a context where users would not reasonably expect them.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code exposes billing-related operations such as creating recharge orders and retrieving account/pricing information, none of which are necessary for answering HS-code description queries. In a user-triggered skill, such hidden commercial/account functionality can be abused to gather sensitive account metadata or initiate unintended financial workflows.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill can request a new API key from a remote service and persist it locally, which is unrelated to HS-code detail lookup and introduces credential lifecycle management into an otherwise informational skill. This creates risk of unauthorized credential creation, local secret sprawl, and abuse of newly minted API access if the skill is triggered unexpectedly or by untrusted workflows.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The version check transmits the skill name to a remote API without any disclosure or consent mechanism in this file. While the data is low sensitivity, undisclosed outbound communication from a content-lookup skill creates privacy and transparency concerns and can surprise users in restricted environments.

Credential Access

High
Category
Privilege Escalation
Content
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
95% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
95% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
Confidence
87% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()
Confidence
84% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
94% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }
Confidence
76% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
94% confidence
Finding
httpx>=0.23.0

Unsafe Defaults

Medium
Category
Tool Misuse
Content
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:
Confidence
86% confidence
Finding
auth=False

Unsafe Defaults

Medium
Category
Tool Misuse
Content
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:
Confidence
86% confidence
Finding
require_auth=False

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196