Search HS codes for analysis reports — find matching HS (Harmonized System) codes by product name and HS code keywords from customs trade data. Returns a list of relevant HS codes that can be used in other analysis report skills for deeper trade data queries. Designed for trade analysts, exporters and import-export professionals who need to locate the correct customs classification codes for specific products before conducting trade data analysis, market research or competitor monitoring across global customs data.

• Outcome: Review
• Latest audit: Jul 20, 2026 · 11:11 AM UTC
• Version: 1.0.0

Overview

The skill is a paid HS-code lookup tool, but it also manages local API credentials, account and top-up workflows, and an undisclosed automatic version check.

Review before installing. Use this only if you are comfortable with a paid external API, local plaintext storage of UPKUAJING_API_KEY under ~/.upkuajing/.env, account/balance/top-up helper commands, and an automatic version check to UpKuaJing. Confirm every charged query or top-up action explicitly, and prefer manually supplying the API key through a safer secret mechanism if your environment supports one.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly involves reading environment variables, reading and writing files under ~/.upkuajing/.env, and making network requests to external APIs. This mismatch weakens user and platform trust boundaries because operators may approve or invoke the skill without realizing it can access credentials, persist data locally, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as an HS code search utility, but the documented workflow also includes account creation, account information retrieval, balance checking, payment/top-up order creation, pricing queries, and local credential storage. That broader behavior materially exceeds user expectations for a simple search skill, increasing the risk of unauthorized account actions, billing surprises, and unnecessary exposure of sensitive account data.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements account authentication, API key issuance, balance queries, and payment/recharge operations, which materially exceed the declared HS-code search purpose of the skill. In an agent-skill context, hidden or unrelated financial/account-management capabilities enlarge the attack surface and can enable unauthorized account actions or unexpected credential handling beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The recharge-order creation function introduces a payment capability that is unrelated to HS-code lookup and could be abused to trigger financial workflows a user did not intend to invoke. In a narrowly scoped search skill, concealed payment functionality is especially risky because users and reviewers may not expect monetary side effects.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatic API key provisioning and local credential storage are outside the stated HS-code search purpose and create a persistent secret-management surface on the host. Even if intended for convenience, embedding credential lifecycle logic in an unrelated skill increases the chance of secret exposure, unauthorized reuse, or misuse by downstream tooling.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This module adds outbound network access and local persistent state to a skill whose stated purpose is HS code lookup, creating hidden side effects outside the expected feature scope. Even though the behavior appears to be a routine update check rather than overtly malicious, undisclosed background requests and filesystem writes expand the attack surface and can surprise users in restricted or privacy-sensitive environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request/response logging helpers can persist full API parameters and responses to local log files, which may include sensitive business queries, results, or account metadata. Although logging is currently disabled by default, enabling it creates a quiet data-retention channel without sanitization, user notice, rotation, or access controls.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The code transmits the skill name to a remote API during normal operation without user notice or consent. While the payload is limited, this is still undisclosed telemetry and can reveal installed capabilities or usage patterns when combined with server logs, especially in enterprise or air-gapped settings.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 94% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58