查询分析报告-HS编码搜索 — 按产品名称和HS编码关键词从海关贸易数据中搜索匹配的HS编码，返回相关HS编码列表，可用于其他分析报告技能进行深入的贸易数据查询。帮助贸易分析师、出口商和进出口从业者在进行贸易数据分析前快速定位正确的海关分类编码——覆盖全球海关贸易数据，是市场研究、竞品监测和贸易情报分析的前置工具。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

This paid HS-code lookup skill is mostly coherent, but it handles API credentials and billing in ways users should review carefully before installing.

Install only if you are comfortable with this skill using a paid Upkuajing API key, storing it in a local plaintext file, and sending queries to the platform. Do not run commands that print the `.env` file, set restrictive permissions on `~/.upkuajing/.env`, and require explicit confirmation before any paid query or recharge-order action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Documentation instructs users to print the API credential file

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API key file is created without explicitly restrictive permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-party dependency is not reproducibly pinned

Content

View full analysis

=0.23.0 ``` The installation instructions in `SKILL.md` direct users to resolve this specification dynamically: ```markdown 2. **安装依赖**：`pip install -r requirements.txt` ``` ### Technical Analysis The requirement accepts every current or future `httpx` release at or above version `0.23.0`. There is no exact version pin, upper bound, lockfile, or package hash. Consequently, two installations of the same Skill can resolve to different dependency code. A future compromised, incompatible, or behavior-changing release could be installed without any corresponding change to the audited Skill package. Because `httpx` is imported by the API client and version-check code, dependency code executes in the Skill process and participates in handling the API credential and network traffic. No evidence was found of dependency confusion, typosquatting, a nonstandard package source, or a currently malicious `httpx` package. This finding concerns reproducibility and future supply-chain exposure. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` instruction. 2. Package resolution selects the newest release satisfying `httpx>=0.23.0`. 3. If that future release or one of its transitive dependencies is compromised, malicious package code is installed. 4. The malicious code executes when imported or invoked by the Skill. 5. It runs with the same operating-system privileges and environment access as the Skill process, potentially including access to `UPKUAJING_API_KEY` and the user's network context. This path depends on an upstream package compromise or unsafe future release; no such active compromise was established by the audit. ### Impact Assessment A compromised dependency would execute with the privileges of the user running the Skill. It ...[truncated 382 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated function is HS code search, but it also performs remote version checks, parses local SKILL.md version data, and maintains cache files in the user's home directory. Undisclosed update-check and local persistence behavior increases attack surface, creates unnecessary outbound requests, and can surprise users who expect a simple query-only skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated function is HS code search, but it also performs remote version checks, parses local SKILL.md version data, and maintains cache files in the user's home directory. Undisclosed update-check and local persistence behavior increases attack surface, creates unnecessary outbound requests, and can surprise users who expect a simple query-only skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated function is HS code search, but it also performs remote version checks, parses local SKILL.md version data, and maintains cache files in the user's home directory. Undisclosed update-check and local persistence behavior increases attack surface, creates unnecessary outbound requests, and can surprise users who expect a simple query-only skill.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading ~/.upkuajing/.env directly and even shows cat ~/.upkuajing/.env, which exposes the entire secrets file rather than only checking for the presence of a needed variable. In an agent setting, direct secret-file access materially raises the risk of credential disclosure to the model, logs, or downstream systems.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow directs the agent to inspect and potentially populate ~/.upkuajing/.env with an API key, including automated key issuance and storage. This creates persistent credential-handling behavior inside a search skill, increasing the chance of secret leakage, unauthorized reuse, or insecure file permissions on the local system.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill again directs manipulation of a local .env file for API key handling, reinforcing a pattern of local plaintext credential storage and manual secret insertion. In context, this is more dangerous because the skill is marketed as a simple HS-code lookup tool, so users may not anticipate credential access and persistence side effects.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements authentication, account lookup, pricing, and recharge/order creation features that are materially broader than the declared HS-code search skill purpose. In an agent-skill context, capability mismatch is dangerous because it can expose billing, credential, and account-management actions to a workflow that users would reasonably expect to be limited to product-code lookup.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This line writes an API key directly into a plaintext .env file, creating a real credential-exposure risk. In a skill whose advertised purpose is only HS-code search, disk persistence of newly minted credentials is especially dangerous because it silently expands trust and can enable subsequent unauthorized API use if the file is read by others.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The recharge-order creation function enables a monetary transaction path unrelated to HS-code search. In a skill package advertised for customs-code lookup, hidden or unexpected billing capabilities raise the risk of unauthorized charges, social engineering, or abuse through exposed agent actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a skill for searching and analyzing HS codes by product name or HS-code keywords. This file instead implements exception reporting to a platform endpoint, including collecting request metadata and sending it to '/agent/skill/error/report', which is a separate operational/telemetry capability rather than HS-code search behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares only high-level metadata and omits an explicit tool/permission scope, yet its documented behavior includes environment access, local file reads/writes, and network/API operations. This weakens containment and informed consent because a caller cannot easily distinguish simple HS-code lookup from broader capabilities like credential handling, reporting, and account operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill can request a new API key and persist it locally, which is a credential-management capability unrelated to the declared search function. In this context, bundled credential issuance and storage increase the risk of silent environment modification, unauthorized API usage, and privilege expansion beyond the user's expectation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code writes a newly issued API key to a local .env file without an explicit pre-write warning or opt-in at the time of execution. Storing credentials on disk in plaintext can expose them to other local users, backups, logs, or accidental disclosure, especially when users do not realize the command will persist secrets.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Account and balance queries expose financial/account metadata that is not necessary for an HS-code lookup tool. Even if read-only, this expands the skill's access scope and may leak sensitive organizational details or balances to users and downstream systems that did not expect such data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Pricing-query functionality is outside the core business goal of HS-code search and reveals monetization/account capability that users may not anticipate. While lower severity than credential or payment actions, it still broadens the skill's operational scope and supports abuse chains involving billing discovery and upsell/manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module can transmit request parameters to a remote API and, when logging is enabled, persist full request and response bodies locally without any built-in redaction of sensitive fields. If product data, identifiers, or credentials are ever included in params or echoed by the API, they may be exposed in local log files and retained longer than intended.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196