查询分析报告-HS编码详情 — 获取指定HS编码的中英文描述信息，帮助贸易从业人员、分析师和进出口从业者了解特定HS编码所代表的具体产品类别。提供全面的产品分类信息，是HS编码查询、海关编码释义、产品分类验证和贸易数据分析准备的基础工具，适用于关税代码查詢、产品归类确认和海关数据分析前的准备工作。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

This paid HS-code lookup skill is purpose-related, but it needs review because it stores API keys in a local plaintext file and can send troubleshooting details to the provider.

Review this before installing if you are uncomfortable with a skill storing a provider API key in ~/.upkuajing/.env, making paid API calls after confirmation, creating recharge orders, or sending error details to the provider. Use a minimally scoped key, avoid putting sensitive business data in error-report context, and verify file permissions on the local .env file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior includes reading environment variables and local files, writing API keys to ~/.upkuajing/.env, and making network requests. This creates a transparency and least-privilege problem: users and hosting systems cannot accurately assess or constrain what the skill can access before execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a simple HS-code description lookup, but it also performs sensitive account-management and billing-related actions such as key provisioning, reading/storing credentials, recharge order creation, pricing queries, and error reporting. This description-behavior mismatch can mislead users into authorizing a much broader operational scope than expected, increasing the chance of unintended credential exposure, billing actions, and external data transmission.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases include broad terms like '海关编码查询' and '产品分类', which can match ordinary conversation and cause the skill to activate outside a narrowly intended context. In a paid, networked skill, overbroad activation increases the risk of unintended external calls or steering users into fee-generating workflows they did not specifically request.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and error context to a central error-reporting API, but it does not require explicit minimization, user notice, consent, or strong constraints on what data may be included. Although it mentions that sensitive fields will be automatically desensitized, that control is unspecified and may not reliably cover free-form context, stack traces, or nested business data, creating a real risk of unintended disclosure of user or operationally sensitive information.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script sends the provided `context` and request metadata to `/agent/skill/error/report` without any visible minimization, redaction, or user-facing disclosure. If `context` contains sensitive request data, prompts, identifiers, or business information, this can cause unintended data exfiltration to the platform during error handling, which is a common privacy and security risk.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs checking and using a local secrets file (~/.upkuajing/.env) and supports automatically saving new API keys there. Accessing or modifying local credential stores is sensitive because it exposes long-lived secrets to the skill workflow and can lead to credential disclosure, persistence beyond the session, or accidental leakage through logs, prompts, or other tools.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the workflow of inspecting and populating ~/.upkuajing/.env with UPKUAJING_API_KEY, including prompting the user to add credentials or auto-saving a newly issued key. That behavior expands the skill from simple data lookup into credential handling and local secret persistence, which materially raises the risk of credential compromise if the environment, filesystem, or downstream scripts are not tightly controlled.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 83% confidence
• Finding: The script writes a newly issued API key into a .env file without showing any file permission hardening or atomic secure creation. If the file is created with permissive default permissions or in a directory accessible by other local users/processes, the credential could be exposed and later abused to access the associated API account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows future major or minor releases to be installed without review. That can introduce breaking changes or a compromised/vulnerable upstream version through the supply chain, reducing build reproducibility and making security posture harder to control.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196