Query HS code detail information for analysis reports — retrieve Chinese and English descriptions for a given HS (Harmonized System) code from customs data. Provides comprehensive product classification details to help trade professionals, analysts and import-export practitioners understand what products a specific HS code represents. Essential for tariff code lookup, product classification verification, customs code interpretation and trade data analysis preparation across global customs trade data.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:04 AM UTC
• Version: 1.0.1

Overview

This paid HS-code lookup skill is not malicious, but it bundles credential storage, account and billing helpers, error reporting, and automatic version checks beyond the narrow lookup description.

Install only if you are comfortable with the skill managing an UpKuaJing API key in a local plaintext file, making paid API calls after confirmation, creating top-up payment links, sending confirmed error reports to the platform, and performing automatic version checks. Avoid placing unrelated secrets or sensitive business context in error-report parameters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a simple HS code lookup tool, but the instructions require capabilities equivalent to environment access, local file reads/writes, and network usage without explicitly declaring or constraining them. This creates hidden execution and data-handling risk because a user or host may grant broader trust than warranted, especially since the skill accesses credentials and can persist data under the home directory.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The published description promises a narrow HS code description lookup, but the skill also instructs the agent to manage API keys, inspect local credential files, create payment/top-up orders, retrieve account information, report errors remotely, and check/update version state. That mismatch is dangerous because it broadens the trust boundary far beyond what a user would reasonably expect from a classification lookup tool, increasing the chance of credential exposure, unwanted charges, or undisclosed data egress.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements authentication and account-management operations for a skill whose declared purpose is only HS-code description lookup. That scope mismatch is dangerous because it introduces credential issuance, account inspection, and billing-related actions that users would not reasonably expect from this skill, increasing the blast radius if the skill is invoked or repurposed.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create recharge/payment orders, which is unrelated to looking up HS-code descriptions. In the context of a simple customs-classification skill, hidden billing capability is especially risky because it could trigger unauthorized financial actions or socially engineer users into payment flows they did not intend.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This function requests and stores new API keys, a credential-management capability outside the stated purpose of HS-code detail lookup. In this context, issuing and persisting credentials materially raises risk because compromise of the skill or misuse by an operator can result in unauthorized account access and downstream abuse of the external platform.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script exposes account-info and pricing-inspection operations unrelated to HS-code detail lookup. While less severe than key issuance or payment creation, these features still expand access to potentially sensitive business metadata and normalize overbroad privileges inside a narrowly scoped skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a platform error-reporting function that is unrelated to the declared skill purpose of HS code detail lookup. In a skill ecosystem, hidden or undeclared secondary capabilities increase supply-chain risk because they can transmit operational data off-path and make the package behavior diverge from what users and reviewers expect.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code sends exception data, request identifiers, paths, and free-form context to a remote endpoint even though the skill is described as a customs-code description lookup tool. That mismatch makes the capability suspicious in context and creates a privacy and data-governance risk, especially if context contains user prompts, product details, or internal workflow information.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module performs outbound network access and persistent local writes that are unrelated to the skill's stated purpose of HS code description lookup. Even though the behavior appears to be for version checking rather than overtly malicious activity, it expands the skill's capability surface, creates an undisclosed telemetry/update channel, and introduces privacy and supply-chain risk if the remote endpoint or local cache is abused.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: A self-update/version-tracking capability is not justified by the declared functionality of a customs code lookup skill, so it represents hidden secondary behavior. Such hidden update-related logic can be leveraged for supply-chain manipulation, silent behavioral changes, or unexpected data flows, making it a real security concern even if the current implementation only checks versions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document instructs agents to report exceptions to a remote API and explicitly includes `requestParams`, `responseData`, and `context`, which commonly contain user inputs, returned records, stack traces, and identifiers. Although it notes that sensitive fields are 'automatically desensitized,' it does not define scope, guarantees, or user-consent/privacy guidance, so the skill creates a real risk of oversharing potentially sensitive data during error reporting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The network request forwards request metadata and arbitrary context without any visible disclosure, consent flow, or filtering in this file. If upstream callers place sensitive data in context, this function can exfiltrate internal details to the platform endpoint during failures, turning ordinary errors into a covert data-sharing path.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code transmits the skill name to a remote API during version checks without any evident user-facing disclosure or consent flow. While the data element is small, undisclosed outbound communication is dangerous because it can leak installation metadata, enable tracking of skill usage, and normalize covert network behavior in a tool whose purpose does not require such transmission.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 96% confidence
• Finding: The skill directs the agent to read `~/.upkuajing/.env` and handle `UPKUAJING_API_KEY`, which is credential material. Any skill that accesses or instructs access to local secret storage expands the blast radius from a simple lookup operation to credential handling; if the agent is over-permissioned or logs values, secrets could be exposed or reused improperly.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 98% confidence
• Finding: This section goes beyond checking for a key and instructs creation and automatic persistence of a newly issued API key into `~/.upkuajing/.env`. Automatically writing secrets to a predictable plaintext location is risky because it normalizes credential persistence in local files, may overwrite existing configuration, and can expose the key to other processes, backups, or later prompts that read the file.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 93% confidence
• Finding: The function explicitly works with a .env file to locate and manage an API key, indicating local credential handling. In this skill context, credential access is more dangerous because secret-management behavior is hidden inside a tool that users expect to only perform HS-code lookups, creating a risk of accidental exposure or misuse of stored keys.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 94% confidence
• Finding: Reading the existing .env file pulls credential material into process memory and enables the script to inspect whether an API key already exists. This expands the skill's access to secrets beyond its stated purpose and can leak sensitive values through logs, errors, or future code changes.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 97% confidence
• Finding: Writing the API key directly to a plaintext .env file persists a sensitive credential in a commonly mishandled location. In a general user skill, this is particularly risky because filesystem secrets are easy to exfiltrate through backups, permissive file permissions, accidental commits, or unrelated tooling that reads dotfiles.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 91% confidence
• Finding: The failure path returns the environment file path and references manual secret handling, reinforcing that credential storage is occurring in user-accessible local files. While the path disclosure alone is not severe, it contributes to discoverability of where secrets live and reflects insecure secret-management design.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows future major or minor versions to be installed without review. This can introduce breaking changes or newly introduced vulnerable versions through the supply chain, reducing build reproducibility and making security posture harder to control.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False on an auth-related endpoint is an unsafe default in this context because it permits sensitive account bootstrap behavior without prior authentication from within a low-scope skill. This broadens abuse opportunities, especially if the skill is exposed to arbitrary users or automation.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False on an auth-related endpoint is an unsafe default in this context because it permits sensitive account bootstrap behavior without prior authentication from within a low-scope skill. This broadens abuse opportunities, especially if the skill is exposed to arbitrary users or automation.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58