查询分析报告-总览 — 按国家维度返回指定HS编码的供应商和采购商数量汇总数据，支持游标分页。提供聚合的贸易活动分布信息，帮助贸易分析师、市场研究人员和进出口从业者了解特定产品在全球各国的贸易活跃度、比较供应商与采购商的市场存在度、识别重点目标市场——覆盖全球220多个国家和地区的海关贸易数据，适用于贸易概览分析、国家维度贸易活跃度评估和战略市场进入规划。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed paid API integration, but it bundles credential storage, account/recharge workflows, error telemetry, and an automatic version-check side effect that deserve Review before installation.

Install only if you are comfortable with this skill storing a vendor API key in a plaintext home-directory .env file, making paid API calls after confirmation, helping create recharge orders, and optionally sending diagnostic context to the vendor. Review error reports before approving them and avoid including sensitive trade data in diagnostic context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares only runtime requirements but omits explicit permissions despite instructing access to environment variables, local files under ~/.upkuajing, network APIs, and writes to a local .env file. This creates an authority/expectation gap: reviewers and users may believe the skill is limited to read-only reporting, while it can read credentials, modify local state, and make billable external requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a narrow overview query, but the skill also describes key provisioning, local credential storage, account inspection, recharge order creation, pricing lookup, exception reporting, and version-check caching. That mismatch is dangerous because users invoking a simple analytics skill may unintentionally trigger credential handling, persistent file writes, network calls, or financially relevant actions they did not reasonably expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements authentication management, API key issuance, account balance lookup, and recharge ordering, which materially exceeds the declared purpose of a read-only customs analysis overview skill. This capability mismatch is dangerous because it introduces credential lifecycle and payment-related operations into a context where users would only expect data retrieval, increasing the chance of unauthorized account actions and abuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The recharge-order creation path enables financial operations unrelated to country-level report overview queries. In the context of a read-only analytics skill, embedding payment initiation functionality is high risk because it expands the attack surface to billing abuse and can trigger user-account actions the operator may not anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This code can create new API keys and persist them locally, which is outside the legitimate scope of a report-overview skill. In skill context, hidden credential provisioning is particularly dangerous because it can silently establish reusable access for later API calls and normalize secret handling in a place users do not expect.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file’s implemented behavior does not match the skill’s declared purpose of read-only customs analysis overview queries. Instead, it performs platform-wide exception reporting to a remote endpoint, which creates a hidden capability outside user expectations and can enable covert telemetry collection or abuse of agent/runtime context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code sends exception telemetry, including arbitrary context, even though the stated skill function is analytics retrieval. In a read-only reporting skill, this extra outbound channel increases risk because sensitive request details, identifiers, or internal state may be exfiltrated under the guise of diagnostics.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module performs outbound network requests to a version API and persists state under the user's home directory, behavior that is unrelated to the declared skill purpose of customs-analysis overview queries. Even if intended for update notifications, the hidden side effects expand the skill's privileges, create a telemetry-like channel, and violate least-privilege expectations for a data-query skill.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring describes only version checking, but the implementation also creates a persistent cache file in the user's home directory. That discrepancy is security-relevant because it conceals filesystem side effects from reviewers and users, making the component less transparent and harder to assess in a skill whose advertised function is unrelated to local persistence.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases include broad natural-language terms such as '分析报告概览' and '报告概览', which can match ordinary user requests and cause unintended activation. Because the skill can lead to billable API calls and credential/account workflows, accidental invocation carries more risk than a harmless read-only lookup.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs agents to send request parameters, response data, and error context to a centralized error-reporting API, and only notes that sensitive fields will be 'automatically desensitized' without defining scope, guarantees, or user consent requirements. In an agent setting, these fields can easily contain user-provided trade data, identifiers, prompts, or internal error traces, so this creates a real privacy and data-sharing risk if developers forward full payloads by default.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The call to the remote error-reporting endpoint transmits a free-form context field without any disclosure or evident minimization. Because context may contain user data, prompts, paths, or system details, this can leak sensitive information to the platform and is more concerning given the skill’s declared non-telemetry purpose.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 94% confidence
• Finding: The skill instructs checking for an API key in ~/.upkuajing/.env and supports workflows that write a newly issued key back to that file. Accessing and persisting secrets in local dotfiles expands the attack surface for credential exposure, especially in a skill whose primary purpose is ostensibly data lookup rather than secret management.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 90% confidence
• Finding: The adjacent workflow continues the same credential-handling pattern by directing the agent to inspect ~/.upkuajing/.env and potentially persist user-provided or newly created API keys there. In context, this is more dangerous because the same skill also initiates billable actions and account operations, so a compromised or over-broad skill could both access credentials and monetize them through external API use.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 90% confidence
• Finding: The function is explicitly handling API-key material via a local .env file path, indicating credential storage behavior. In this skill's context, local secret management is more dangerous because the skill is supposed to be a read-only analytics interface, so secret persistence is unexpected and may expose credentials to other local users, backups, logs, or misconfigured file permissions.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 91% confidence
• Finding: Reading an existing .env file to discover API-key material constitutes credential access behavior. Even though it appears intended for convenience, this broad file-based secret access increases exposure of sensitive keys and is misaligned with the least-privilege expectations of a simple report overview skill.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: Writing the API key into a plaintext .env file is a direct credential persistence vulnerability. Plaintext secrets on disk are easily disclosed through weak filesystem permissions, shell tooling, backups, accidental commits, or co-tenant access, and the danger is amplified because this functionality is unnecessary for the stated analytics-only purpose.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound range only (httpx>=0.23.0), which allows installation of any newer version, including releases with breaking changes or newly introduced supply-chain issues. This makes builds non-reproducible and can unintentionally pull vulnerable or incompatible versions over time.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 83% confidence
• Finding: The explicit require_auth=False parameter disables authentication for the key-creation request, making the unsafe behavior clear in code. In this context, that is dangerous because an analytics skill should not be able to bootstrap privileged access or create reusable credentials without prior trust establishment.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 83% confidence
• Finding: The explicit require_auth=False parameter disables authentication for the key-creation request, making the unsafe behavior clear in code. In this context, that is dangerous because an analytics skill should not be able to bootstrap privileged access or create reusable credentials without prior trust establishment.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196