Search HS codes for analysis reports — find matching HS (Harmonized System) codes by product name and HS code keywords from customs trade data. Returns a list of relevant HS codes that can be used in other analysis report skills for deeper trade data queries. Designed for trade analysts, exporters and import-export professionals who need to locate the correct customs classification codes for specific products before conducting trade data analysis, market research or competitor monitoring across global customs data.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.1

Overview

This appears to be a real HS-code lookup skill, but it also handles local API keys, paid account flows, error reporting, and automatic version-check state in ways users should review first.

Before installing, confirm you are comfortable with a paid UpKuaJing integration that reads and may write UPKUAJING_API_KEY in ~/.upkuajing/.env, can create top-up payment URLs after a user-directed flow, may send confirmed error reports, and automatically checks UpKuaJing for skill version information while writing a local cache. Use a dedicated API key, review fees before each paid call, and protect the local .env file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares itself as a simple HS code search utility, but the instructions clearly require capabilities including environment-variable access, reading and writing files under the user's home directory, and making network requests. Undeclared sensitive capabilities reduce transparency and can bypass user expectations or policy controls, especially because the skill handles credentials and payment-related flows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is HS code lookup, but the skill also includes account provisioning, local credential storage, balance retrieval, payment order creation, pricing queries, remote error reporting, and version-check/cache behavior. This mismatch is dangerous because users may invoke a low-risk lookup skill without realizing it can trigger broader account, billing, telemetry, and local state changes.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements account-management, API key issuance, balance lookup, pricing, and recharge flows that are outside the declared HS code search purpose. In an agent skill context, this expands the trust boundary and introduces unnecessary access to billing and credential lifecycle operations, increasing the risk of unauthorized account actions or abuse if the skill is invoked unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill can create recharge/payment orders via /agent/auth/pay/url, which is unrelated to customs code search and enables financial-side effects. In an agent environment, hidden or unnecessary billing functionality is dangerous because it could be triggered without users expecting account charges or payment workflows.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code provisions new API keys and persists them locally to a .env file, which is not justified by the stated HS code search functionality. Unnecessary credential issuance and storage increase the attack surface and can lead to credential exposure, persistence, or misuse by other local processes or users.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements outbound error reporting to a platform endpoint, which is outside the stated purpose of an HS code search skill. Even if framed as observability, it creates an additional data egress path where request metadata and free-form context may be transmitted off-functionality, potentially exposing sensitive user, prompt, or operational data if the context contains it.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The exception-reporting feature is not justified by the declared HS code lookup functionality, so it represents hidden or unnecessary capability. Because it accepts arbitrary context and forwards it to a remote endpoint, the feature increases the risk of unintended disclosure and makes the skill more dangerous in context: users invoking customs lookup would not reasonably expect unrelated platform reporting behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound network access and persistent local state writes that are unrelated to the stated HS-code lookup purpose of the skill. Even if intended for update checking, the behavior expands the skill’s trust boundary by leaking installation/use metadata to a remote service and creating hidden side effects on the host, which is risky in an agent skill context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill contains self-update/version telemetry logic that is not justified by customs HS-code analysis functionality. In practice this enables unsolicited communication with an external endpoint about the installed skill, which can disclose operational metadata and create a covert dependency on a remote service during ordinary use.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs agents to send request parameters, response payloads, error context, and unique identifiers to an error-reporting endpoint, but it does not require explicit minimization, user notice, or strong restrictions on what may be included in those fields. Even though it says sensitive fields will be automatically desensitized, that is not a sufficient guarantee because stack traces, request parameters, and response bodies commonly contain secrets, personal data, or commercially sensitive customs data that may not be fully scrubbed before transmission.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 90% confidence
• Finding: The skill instructs the agent to inspect `~/.upkuajing/.env` for `UPKUAJING_API_KEY`, which is credential material stored in a sensitive local file. Even if intended for setup, encouraging automated access to a secrets file increases the risk of credential exposure, over-collection, or misuse by an agent operating with broad file permissions.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: The skill goes beyond checking for a key and directs creation or automatic saving of a newly issued API key into `~/.upkuajing/.env`. Writing credentials into a local dotfile from an agent workflow creates persistence of secrets on disk and increases the attack surface if filesystem access, logging, backups, or other tools can read that file.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 83% confidence
• Finding: The function is explicitly designed to work with a .env file holding an API key, indicating local credential handling within the skill. Even though this line only references the path, in context it is part of a workflow that reads and later writes secrets to a plain-text file, which can expose credentials through weak file protections or operational mistakes.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 95% confidence
• Finding: This code reads the .env file contents to locate an existing API key, meaning the skill directly accesses locally stored credentials. Plain-text credential access in a utility skill increases the chance of accidental disclosure, misuse, or future expansion into broader secret harvesting behavior.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 98% confidence
• Finding: The code writes the newly issued API key directly into a .env file in plain text. Persisting credentials this way creates a durable local secret that may be exposed through permissive filesystem access, backups, logs, or accidental sharing, and is especially concerning because the skill's declared purpose does not require credential-management behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: The dependency is specified with a lower bound only (`httpx>=0.23.0`), which allows future major or minor releases to be installed without review. That can introduce breaking changes or newly introduced vulnerabilities into the skill's runtime, reducing build reproducibility and making supply-chain risk harder to control.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False establishes an unsafe default for a sensitive operation: issuing credentials. In the context of an HS code search skill, unauthenticated key provisioning is unnecessary and increases the chance of misuse or unintended access paths.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False establishes an unsafe default for a sensitive operation: issuing credentials. In the context of an HS code search skill, unauthenticated key provisioning is unnecessary and increases the chance of misuse or unintended access paths.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58