查询分析报告-HS编码搜索 — 按产品名称和HS编码关键词从海关贸易数据中搜索匹配的HS编码，返回相关HS编码列表，可用于其他分析报告技能进行深入的贸易数据查询。帮助贸易分析师、出口商和进出口从业者在进行贸易数据分析前快速定位正确的海关分类编码——覆盖全球海关贸易数据，是市场研究、竞品监测和贸易情报分析的前置工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

This HS-code lookup skill is not malicious, but it needs review because it handles local API keys, account/billing helpers, diagnostics, and automatic version-check traffic beyond the narrow search description.

Install only if you are comfortable sending HS-code/product queries to UpKuaJing, storing the API key in ~/.upkuajing/.env, and allowing account, pricing, recharge-order, error-report, and update-check helper calls. Do not let the agent print the .env file or include secrets, personal data, or proprietary trade details in diagnostic reports; require explicit confirmation before any paid or billing-related action.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes capabilities beyond a simple HS code lookup, including reading environment/config files, writing to local storage, and making networked account-management and reporting calls, yet it declares no explicit permissions. This creates a transparency and consent gap: an agent or user may authorize what appears to be a narrow lookup skill while it can also access secrets and modify local state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is HS code search, but the skill also handles API key provisioning/storage, account info retrieval, recharge order creation, pricing queries, local caching, and exception reporting. This description-behavior mismatch is dangerous because users may consent to a benign search workflow without realizing the skill can access credentials, create billing-related actions, and transmit operational data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs callers to send request parameters, response payloads, and exception context to an error-reporting endpoint, but it does not require explicit minimization, allowlisting, or user/operator warning before transmitting potentially sensitive business data. Although it notes that sensitive fields are 'automatically desensitized,' that claim is undefined and may not cover all secrets, personal data, or proprietary customs/trade information, creating a real risk of unintended data disclosure to the platform.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code sends arbitrary request parameters to an external third-party API over the network, but this file contains no user-facing notice, consent check, or data minimization guard before transmission. In a skill context, user-supplied product descriptions or HS-code queries may contain commercially sensitive data, so silent exfiltration to a remote service creates a real privacy and data-handling risk even though TLS is used.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The code makes an outbound POST request to a remote version-check endpoint and transmits the skill name automatically, with no visible consent, disclosure, or configuration gate in this module. While the transmitted data is limited, silent network activity can violate user expectations, leak installed-skill metadata, and create privacy/compliance issues in environments that restrict undeclared telemetry.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs reading `~/.upkuajing/.env` for `UPKUAJING_API_KEY` and supports obtaining and automatically saving new keys there. Accessing and managing secrets in local files is highly sensitive; if the skill or surrounding agent mishandles output, logs, or prompts, credentials could be exposed or overwritten, leading to account compromise and billable API abuse.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the credential-handling flow by directing checks of the local `.env` file and automatic persistence of a newly issued API key. In the context of a search skill, this broadens exposure from mere use of a provided credential to local secret discovery and storage, increasing the risk of leakage, tampering, and unauthorized future use.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 82% confidence
• Finding: The code writes a newly issued API key into a .env file without any visible step to restrict file permissions. On multi-user systems or misconfigured environments, secrets stored in plaintext may be readable by other local users or inadvertently included in backups, sync tools, or source control, leading to credential compromise.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 70% confidence
• Finding: On error, the function returns the full path to the environment file containing credentials. While not a secret by itself, exposing the precise credential storage path can aid local attackers or downstream logging systems by revealing where to look for sensitive material.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower-bound only (`httpx>=0.23.0`), which allows installation of any newer major or minor release and can introduce unexpected vulnerable or incompatible versions through supply-chain drift. While this is not an immediately exploitable flaw by itself, it weakens build reproducibility and can expose the skill to future dependency breakage or newly introduced security issues.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196