查询分析报告-总览 — 按国家维度返回指定HS编码的供应商和采购商数量汇总数据，支持游标分页。提供聚合的贸易活动分布信息，帮助贸易分析师、市场研究人员和进出口从业者了解特定产品在全球各国的贸易活跃度、比较供应商与采购商的市场存在度、识别重点目标市场——覆盖全球220多个国家和地区的海关贸易数据，适用于贸易概览分析、国家维度贸易活跃度评估和战略市场进入规划。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed paid API integration, but it handles billing and local API keys in ways users should review before installing.

Install only if you are comfortable with a Chinese-language paid Upkuajing API skill that stores an API key locally. Do not run or share output from `cat ~/.upkuajing/.env`; prefer a securely managed environment variable or secret store, confirm every paid query or recharge action explicitly, and review any error report before sending it to avoid including sensitive business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Credential Exposure Through Documented Shell Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API Key File Created Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Installation

Content

View full analysis

=0.23.0 ``` Documented installation command in `SKILL.md`: ```markdown 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The dependency declaration specifies only a lower bound. Package resolution may therefore install any future `httpx` version accepted by the package index, including releases that were not reviewed with this Skill. No lockfile or cryptographic hashes constrain the resolved package and its transitive dependencies. There is no evidence that the named package is typosquatted or currently malicious. The risk is the lack of reproducibility and integrity constraints: future compromised, incompatible, or behavior-changing releases can enter the execution environment through the documented installation process. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver contacts the configured Python package index. 3. It selects the newest version satisfying `httpx>=0.23.0`, along with unconstrained transitive dependencies. 4. A future compromised or otherwise unsafe release is downloaded and installed. 5. Malicious installation or runtime behavior executes with the permissions of the user running pip or the Skill. This path depends on a compromised package release, package index, dependency, or resolver configuration; the repository itself does not contain evidence of an actively malicious dependency. ### Impact Assessment The impact depends on the privileges used for installation and execution. In a typical user environment, a compromised dependency could access that user's files, environment variables, and API credentials, and could make network requests. If dependencies are installed with elevated privileges, ...[truncated 194 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version checking, parsing local metadata, caching version information, and contacting a remote version endpoint are behaviors outside the skill's declared purpose of returning trade overview data. These extra behaviors widen the attack surface and can expose local state or create unexpected outbound traffic not anticipated by the user.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Version checking, parsing local metadata, caching version information, and contacting a remote version endpoint are behaviors outside the skill's declared purpose of returning trade overview data. These extra behaviors widen the attack surface and can expose local state or create unexpected outbound traffic not anticipated by the user.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version checking, parsing local metadata, caching version information, and contacting a remote version endpoint are behaviors outside the skill's declared purpose of returning trade overview data. These extra behaviors widen the attack surface and can expose local state or create unexpected outbound traffic not anticipated by the user.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version checking, parsing local metadata, caching version information, and contacting a remote version endpoint are behaviors outside the skill's declared purpose of returning trade overview data. These extra behaviors widen the attack surface and can expose local state or create unexpected outbound traffic not anticipated by the user.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading the full ~/.upkuajing/.env file using cat, which can expose the API key and any other secrets stored in that file to the agent, logs, or user-facing output. Direct secret file access is especially risky in a skill whose declared purpose is merely querying overview data, making the credential access broader than necessary.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill directs the workflow to inspect whether UPKUAJING_API_KEY exists in a local .env file and to obtain or save a new key there. This creates a pattern of local credential discovery and persistence that can expose secrets, normalize unsafe handling practices, and allow unrelated agent logic to access them.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The instructions explicitly contemplate manually adding secrets to ~/.upkuajing/.env or auto-saving newly created API keys there. Plaintext storage of long-lived credentials on disk increases the risk of disclosure through file reads, backups, logs, multi-user access, or later compromise of the host environment.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements authentication management, API key issuance, account lookup, recharge ordering, and pricing queries, which are materially outside the declared skill purpose of report-overview/statistics retrieval. In an agent-skill context, excess capabilities expand the attack surface and can enable unauthorized financial or account operations if the skill is invoked unexpectedly or chained by another component.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code opens and reads the local .env file to inspect an existing API key, which means this skill directly handles stored credentials. In this context, a report-query skill should not need to read long-lived secrets from plaintext files; doing so increases exposure to accidental leakage, overbroad access, and secret reuse by unrelated functionality.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The code writes a newly issued API key directly into a plaintext .env file under the user's home directory. Persisting long-lived credentials in plaintext materially increases the chance of compromise through local disclosure, backups, logs, developer tooling, or other processes that can read user files.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Creating recharge/payment orders is a financial action unrelated to the advertised report overview functionality. Exposing purchase/payment primitives inside a data-query skill increases the risk of confused-deputy behavior, misuse by downstream agents, or unauthorized charges if the script is accessible through broader automation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

技能清单声明该技能用于“查询分析报告-概览数据”，按国家维度获取供应商/采购商数量等信息并支持分页；但此文件核心行为是收集 skillId、requestId、requestPath、context 并调用 /agent/skill/error/report 上报异常。异常遥测上报并不是“报告概览查询”语义下显式声明的功能，和清单描述的业务能力明显不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope even though its instructions require reading environment files, writing local credential/config files, and making networked API calls. Without a clear allowlist of permitted capabilities, an agent may grant broader access than users expect, increasing the risk of unintended file access, credential handling, and outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill name, description, examples, workflow guidance, and user-facing instructions are entirely Chinese, with no indication that the user can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest description advertises trigger phrases such as “国家统计数据” and “报告概览”, which are broad and not clearly constrained to this specific customs-analysis skill. The file does not provide exclusion conditions or negative examples to clarify when these phrases should or should not invoke the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document instructs agents to send request parameters, response data, and error context to an error-reporting endpoint, which can include sensitive business data, identifiers, or stack traces. Although it says sensitive fields are 'automatically desensitized,' it does not define the protection scope, obtain user consent, or require explicit minimization, creating a real privacy and data-leakage risk if operators forward raw payloads during failures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing CLI descriptions/messages are written only in Chinese, which indicates a fixed language choice for the skill's interface. The file does not offer any user opt-in, locale selection, or justification that the skill is intended only for a Chinese-language or region-specific audience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code can request a new API key and persist it locally, which is far more sensitive than the declared read-only analytics use case. Combining credential provisioning with a reporting skill creates an unnecessary credential-access path and may let an agent obtain long-lived secrets that can later be abused for broader API access.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Disabling authentication for the '/agent/auth/create' request is an unsafe default in the context of a narrowly scoped analytics skill. It enables a capability escalation path where the component can obtain credentials without prior trust establishment, which is unnecessary for simple report retrieval and widens the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196