查询分析报告-HS编码搜索 — 按产品名称和HS编码关键词从海关贸易数据中搜索匹配的HS编码，返回相关HS编码列表，可用于其他分析报告技能进行深入的贸易数据查询。帮助贸易分析师、出口商和进出口从业者在进行贸易数据分析前快速定位正确的海关分类编码——覆盖全球海关贸易数据，是市场研究、竞品监测和贸易情报分析的前置工具。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This skill is a paid HS-code search integration that discloses its API-key, billing, and recharge flows, but users should understand the local credential storage and automatic version-check side effects.

Install only if you are comfortable with a paid third-party API skill storing an API key in plaintext at ~/.upkuajing/.env, reading account balance details, creating recharge payment URLs when guided, and making an automatic version-check request/cache write during API calls. Review charges before confirming any query or recharge flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares a narrow HS-code search purpose but instructs the agent to read environment secrets, write to a local .env file, and perform networked account and billing operations. Undeclared file, credential, and network capabilities increase the attack surface and can surprise users or host systems that rely on the declared metadata for trust decisions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond simple HS-code search into API key provisioning, local credential storage, account inspection, recharge order creation, payment-link handling, and price queries. This mismatch can mislead users and reviewers about the real privileges and side effects of the skill, making sensitive operations more likely to occur under the guise of a benign search tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script implements API key issuance, account information retrieval, pricing lookup, and recharge-order creation, which materially exceeds the declared purpose of an HS code search skill. In an agent-skill ecosystem, undeclared financial/account-management capabilities expand the attack surface and can surprise operators or downstream agents into invoking sensitive actions unrelated to customs classification.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The recharge-order creation function enables payment initiation from a skill whose declared role is only HS code lookup. Even if it only returns a payment URL, embedding billing initiation in an unrelated skill creates an opportunity for deceptive prompting, unauthorized charges, or misuse by agents that trust the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Account balance and pricing queries expose financial/account metadata that is unrelated to HS code search. In the context of a narrowly described customs lookup tool, this hidden capability can leak sensitive business information and enables reconnaissance for later abuse of the associated account.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module docstring explicitly states this is an authentication-management component providing API key application and recharge functions, directly contradicting the declared HS-code-search purpose. This mismatch is dangerous because users and orchestrators may grant trust or permissions based on the skill metadata while the code performs unrelated sensitive operations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module performs outbound network access to a remote version service and writes persistent state to the user's home directory, which exceeds the stated purpose of an HS code search skill. Even if intended for maintenance, this creates hidden side effects, expands the attack surface, and can leak usage metadata or enable unwanted remote influence over local behavior.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code contacts an external API endpoint to check for newer skill versions, despite this capability not being necessary for HS code lookup. Such undeclared remote communication can expose environment or usage information, and if the configured base URL is attacker-controlled, it can be abused for unauthorized data egress or to steer users toward malicious updates.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The skill stores persistent cache data under the user's home directory without this being part of its core HS code search function. While the data written here is limited, undeclared persistent writes can violate least-privilege expectations, create forensic artifacts, and become a foothold for abuse if combined with other malicious behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The request/response logging helpers can persist full request parameters and API responses to ~/.upkuajing/logs when ENABLE_API_LOGGING is enabled, with no redaction logic. If sensitive product data, identifiers, or server-returned confidential information are included, they may be stored in plaintext local logs and exposed to other local processes or users with filesystem access.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196