ClawHub
Back to skill

Security audit

查询分析报告-总览 — 按国家维度返回指定HS编码的供应商和采购商数量汇总数据，支持游标分页。提供聚合的贸易活动分布信息，帮助贸易分析师、市场研究人员和进出口从业者了解特定产品在全球各国的贸易活跃度、比较供应商与采购商的市场存在度、识别重点目标市场——覆盖全球220多个国家和地区的海关贸易数据，适用于贸易概览分析、国家维度贸易活跃度评估和战略市场进入规划。

Security checks across malware telemetry and agentic risk

Overview

This paid customs-data skill is mostly transparent, but it includes account, billing, plaintext API-key storage, and an undisclosed automatic version-check network call beyond a simple report query.

Review this skill carefully before installing. It will call an external paid API, use or create an API key, may save that key in plaintext under ~/.upkuajing/.env, can create recharge payment URLs, and automatically checks a remote version endpoint once per day during API use. Only install it if you are comfortable with those account and billing behaviors and can protect the local credential file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares itself as a simple report-query capability, but the instructions clearly require reading environment secrets, accessing local files under the user's home directory, writing credentials, and making network calls. This hidden capability expansion is dangerous because users and calling systems cannot accurately reason about the skill's trust boundary or apply least-privilege controls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is country-level overview queries, but the skill also instructs the agent to create API keys, inspect account information, generate payment orders, manage local credential files, and check remote version state. That mismatch materially increases risk because a user invoking a data-query skill may unknowingly trigger credential lifecycle or billing-related operations.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The file implements authentication management, API key issuance, account lookup, and recharge/payment operations even though the declared skill is only for report-overview and country statistics queries. This capability mismatch expands the privilege and financial attack surface: an agent or user invoking this skill gains access to sensitive account and billing functions unrelated to the stated purpose.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Creating recharge orders and returning payment URLs introduces a financial-operation capability that is unrelated to a reporting overview skill. If exposed through an agent, this can trigger unauthorized billing workflows, confuse users about the skill's purpose, and enable abuse of account funds or payment channels.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code can request a new API key and persist it locally, which is materially broader than the declared data-query function of the skill. In an agent setting, this creates unnecessary credential lifecycle handling and increases the chance of secret issuance, storage, and misuse without clear user expectation.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The module performs outbound network requests and writes persistent cache data under the user's home directory even though the skill's declared purpose is customs-analysis reporting. This expands the skill's trust boundary and creates an unnecessary telemetry/update channel that could expose environment metadata, surprise users, or be abused if the configured API endpoint is untrusted or compromised.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This code adds a self-update/telemetry capability unrelated to the business function of querying trade overview data. Even though it only sends the skill name, it introduces covert network behavior and local state tracking, which is risky in a plugin/skill context because it can be repurposed for monitoring or become a dependency on an external service outside the user's expectations.

Credential Access

High
Category
Privilege Escalation
Content
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
93% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
93% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
88% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }
Confidence
72% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
90% confidence
Finding
httpx>=0.23.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196