Query analysis report overview data — retrieve supplier and buyer counts grouped by country for a specified HS code with cursor-based pagination. Provides aggregated trade activity distribution data to help trade analysts, market researchers and import-export professionals understand which countries are most active in trading a specific product, compare supplier versus buyer market presence and identify key target markets. Designed for comprehensive trade overview analysis, country-level trade activity assessment and strategic market entry planning across 220+ countries and territories.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:50 AM UTC
• Version: 1.0.1

Overview

This is a paid customs-data query skill, but it also handles local API keys, account/top-up actions, error reporting, and an automatic version check, so it belongs in Review rather than normal install.

Install only if you are comfortable with this skill storing an UpKuaJing API key in a local plaintext dotfile, making paid API calls after confirmation, offering account/top-up helper actions, and optionally sending error details to UpKuaJing. Review prompts carefully before approving key creation, payment-order creation, fee-incurring queries, or error reports, and avoid putting secrets or sensitive business details in report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares a narrow purpose but instructs use of environment variables, local file access to ~/.upkuajing/.env, and networked scripts without explicitly declaring those capabilities. Hidden or undeclared capabilities reduce transparency and can enable unexpected credential handling, local file reads/writes, and outbound requests that a user may not reasonably expect from a simple overview query skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a read-only overview query, but the skill also includes account enrollment, credential storage, billing/top-up flows, account info retrieval, and remote error reporting. This mismatch broadens the attack surface and can mislead users into authorizing sensitive operations unrelated to the stated task, especially where credentials and payments are involved.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements authentication management, API key issuance, account lookup, recharge-order creation, and pricing queries, which are materially unrelated to the declared skill purpose of analysis-overview country statistics. That scope mismatch is dangerous because it expands the skill's authority into credential and billing operations, increasing the chance of unauthorized account actions or abuse if the skill is invoked unexpectedly or bundled into a broader agent workflow.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The ability to create recharge/payment orders is unjustified for a read-oriented analysis-overview skill and introduces a financial side-effecting operation into a context where users would expect data retrieval only. In an agent setting, this raises the risk of unintended charges, abuse of payment flows, or social-engineering through generated payment URLs.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Provisioning new API keys and storing them locally is outside the declared scope of a country-statistics overview skill and introduces credential lifecycle management where only data querying should exist. This broadens the attack surface and can lead to uncontrolled key issuance, accidental credential exposure, or misuse by downstream tooling that inherits the generated key.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: A read-oriented reporting skill normally should not need to transmit operational telemetry containing request metadata and free-form context to a remote endpoint. In this skill context, the extra reporting path broadens data exposure and can leak identifiers, request paths, or user-derived error context to the platform without strong minimization controls visible in the code.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This module performs outbound network requests and writes persistent local cache data even though the skill is described as a trade-analysis overview tool. That behavior creates unnecessary data egress and local state side effects outside the declared purpose, which is risky in an agent context because hidden update-check logic can become a telemetry or command channel if the configured API base URL is untrusted or later compromised.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: A self-update or version-tracking capability is not justified by the stated purpose of retrieving supplier/buyer country statistics, so it expands the skill's privileges and behavior beyond user expectations. In a security review, this mismatch is itself dangerous because it enables undisclosed communication with external infrastructure and establishes persistent tracking state, increasing the attack surface without functional need.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly encourages sending raw request parameters, response data, and exception context to an error-reporting endpoint. Even though it states that sensitive fields will be automatically masked, it does not define what is considered sensitive, does not require minimization, and does not warn operators that logs and stack traces may contain personal data, secrets, or commercial information. In a customs/trade-analysis skill, those payloads can plausibly include supplier/buyer identifiers, country trade details, internal request metadata, or tokens accidentally captured in context, creating a real privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends skillId, skillVersion, requestId, requestPath, and context to '/agent/skill/error/report' without any user-facing disclosure or evidence of sanitization. Because 'context' is free-form and may contain user content, stack traces, or sensitive business details, this creates a privacy and data-leakage risk that is more concerning in a seemingly read-only analysis skill.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill directs reading from and writing to ~/.upkuajing/.env to manage API keys, which is credential access and persistence on the local filesystem. Even if intended for setup, this is dangerous because it normalizes direct handling of secrets in a general-purpose skill and could expose or overwrite credentials if the skill or surrounding tooling is compromised or overly permissive.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: This section explicitly tells the agent to check for an API key in ~/.upkuajing/.env and to save a newly created key there automatically. That behavior grants the skill access to credentials and persistent local storage beyond its stated reporting purpose, increasing the risk of secret exposure, unauthorized reuse, or silent modification of authentication material.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 87% confidence
• Finding: The code manages API credentials via a local .env file, which can expose secrets through weak filesystem permissions, backups, accidental inclusion in archives, or other local disclosure paths. In this skill context, storing newly issued keys on disk is more dangerous because credential handling is unrelated to the expected analysis-only function, so users may not anticipate secret persistence.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 82% confidence
• Finding: Reading an existing .env file to inspect API keys constitutes credential access logic that can expose or normalize secret handling inside the skill. Although the code only checks for an existing key, any in-skill parsing of plaintext secret files increases the chance of leakage, misuse, or future expansion into more invasive credential processing.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 91% confidence
• Finding: Writing the newly issued API key directly to a .env file persists a sensitive secret in plaintext on disk. If the host is shared, backed up, synchronized, or loosely permissioned, the key can be stolen and then used to access the associated API account or incur costs.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 78% confidence
• Finding: The error path instructs users to manually set the API key environment variable, reinforcing direct handling of raw credentials outside a controlled secret-management workflow. While the line itself is not the primary exposure, it is part of an insecure credential-handling design that encourages ad hoc secret placement and potential leakage through shell history, process listings, or misconfiguration.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer major or minor release. That can introduce unreviewed upstream changes or a compromised/broken future release into the skill's environment, reducing build reproducibility and making supply-chain risk harder to control.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The explicit require_auth=False setting weakens the default trust boundary by making a sensitive operation proceed without prior authentication. In the context of a read-only analysis skill, this is especially risky because users and orchestrators would not expect the skill to contain unauthenticated credential provisioning behavior.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The explicit require_auth=False setting weakens the default trust boundary by making a sensitive operation proceed without prior authentication. In the context of a read-only analysis skill, this is especially risky because users and orchestrators would not expect the skill to contain unauthenticated credential provisioning behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58