查询分析报告-贸易占比 — 按贸易量排名返回指定HS编码下各企业的贸易份额数据，包含贸易次数、占比、数量、金额和合作伙伴数量，支持出口国/进口国类型筛选和最近月数筛选。帮助贸易分析师、采购代理和市场研究人员识别特定产品的主要交易企业、分析市场集中度、评估供应商竞争格局并发现潜在贸易伙伴——覆盖全球220多个国家和地区的海关贸易数据，是市场集中度分析和竞争力评估的核心工具。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.1

Overview

This looks like a legitimate paid customs-data query skill, but it needs review because it can expose or persist API keys and includes account, payment, error-reporting, and update-check behavior beyond the core query.

Review this skill before installing if the API account has real spending value. Prefer setting UPKUAJING_API_KEY through a secure environment or secret store, do not run commands that print the .env file, check charges before each query, and avoid sending raw request or response bodies in error reports if they may contain sensitive business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Credential Disclosure Through Documented Plaintext File Display

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–47
Vulnerability Type: Credential exposure through unnecessary plaintext output
Risk Level: Medium

Vulnerable Code Snippet

The instructions identify the credential file and direct the Agent to display its complete contents:

bash

cat ~/.upkuajing/.env

The documented file content is:

text

UPKUAJING_API_KEY=your_api_key_here

The surrounding instructions require checking this file for UPKUAJING_API_KEY.

Technical Analysis

Reading UPKUAJING_API_KEY is necessary for the authenticated trade-analysis API. Displaying the entire credential file is not necessary to determine whether the variable exists.

If the Agent follows the documented command, the plaintext API key may enter terminal output, Agent conversation context, command transcripts, screen recordings, CI logs, or other monitoring systems. This exceeds the minimum access required by the Skill because a non-disclosing existence check would provide the same operational result.

The code does not send the key to an unrelated domain. Authenticated requests use the fixed HTTPS endpoint https://openapi.upkuajing.com. The issue is unnecessary local disclosure rather than confirmed credential exfiltration.

Attack Path

1. A user or Agent follows the environment setup procedure in SKILL.md.
2. The command cat ~/.upkuajing/.env is executed.
3. The complete API key is printed to standard output.
4. Terminal logging, Agent context retention, screen sharing, or another local observer captures the output.
5. An unauthorized party reuses the Bearer credential to invoke authenticated platform APIs.

Impact Assessment

A disclosed key may allow unauthorized use of the associated API account. Based on the audited scripts, accessible operations can include billable trade queries, retrieval of account information, creation of recharge orders, pricing requests, an ...[truncated 235 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to display the complete .env file.

• Use a non-disclosing presence check, for example:

  bash

  grep -q '^UPKUAJING_API_KEY=.' ~/.upkuajing/.env
  

• Prefer checking whether the environment variable is set without printing its value:

  bash

  test -n "${UPKUAJING_API_KEY:-}"
  

• Instruct users to configure credentials directly rather than supplying them through Agent messages.

• Ensure error messages report only whether a credential is missing or invalid and never include the credential value.

• Advise users to rotate any key that has already appeared in terminal logs, chat context, or other retained output.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:65

Finding

API Key File Created Without Explicit Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 65–74
Vulnerability Type: Insecure plaintext credential storage permissions
Risk Level: Medium

Vulnerable Code Snippet

python

try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

The security-relevant operations in the original code are the directory creation without an explicit mode and the direct plaintext write through open(..., 'w').

Technical Analysis

The script stores a newly issued API key in ~/.upkuajing/.env, but it does not explicitly enforce owner-only permissions on either the directory or the credential file.

File creation permissions therefore depend on the process umask. With a permissive umask, the file may be readable by other local users. If the file already exists, opening it in write mode truncates it but generally retains its previous permission bits, including any unsafe permissions.

Plaintext storage is expected by the Skill’s current configuration design, but the absence of explicit access-control hardening violates least-privilege handling for an authentication secret.

Attack Path

1. A user runs python scripts/auth.py --new_key.
2. The platform returns a new API key.
3. The script writes the key to ~/.upkuajing/.env using umask-dependent permissions.
4. A local user or process checks the file’s permissions and reads it if access is allowed.
5. The attacker uses the recovered key as a Bearer token against the platform API.

Exploitation requires local access under an identity permitted by the resulting filesystem mode. The audit did not find remote filesystem exposure or ...[truncated 490 chars]

Remediation

View remediation

Remediation Suggestions

• Create the credential directory with owner-only permissions and enforce the mode even when it already exists:

  python

  UPKUAJING_DIR.mkdir(parents=True, exist_ok=True, mode=0o700)
  os.chmod(UPKUAJING_DIR, 0o700)
  

• Create the credential file atomically with mode 0600:

  python

  fd = os.open(
      env_file,
      os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
      0o600,
  )
  try:
      with os.fdopen(fd, "w", encoding="utf-8") as f:
          f.write(f"{API_KEY_ENV}={api_key}\n")
  finally:
      os.chmod(env_file, 0o600)
  

• Consider writing to a securely created temporary file in the same directory and atomically replacing the destination.

• Reject or repair unsafe permissions on an existing credential file before reading or rewriting it.

• Prefer an operating-system credential store or secret manager where supported.

• Avoid including any portion of the existing key in status messages. The current code reveals the first ten characters of an existing key, which is unnecessary.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1; installation instruction in SKILL.md, line 20
Vulnerability Type: Non-reproducible dependency resolution without integrity verification
Risk Level: Low

Vulnerable Code Snippet

requirements.txt contains:

text

httpx>=0.23.0

SKILL.md instructs installation with:

bash

pip install -r requirements.txt

Technical Analysis

The lower-bound-only constraint permits pip to install any later httpx version and its resolved transitive dependencies. No lock file or package hashes are supplied.

The package name is legitimate, and the project does not configure a suspicious package index, direct URL, or typosquatted dependency. Nevertheless, future installations are not reproducible and may introduce unreviewed behavior, compatibility changes, or a compromised future release.

This is a supply-chain hardening deficiency rather than evidence that the current dependency is malicious.

Attack Path

1. A user follows the documented installation command.
2. Pip resolves the newest version satisfying the open-ended constraint.
3. Pip also resolves transitive dependencies according to the package metadata available at installation time.
4. An unreviewed, compromised, or incompatible future release is downloaded and installed.
5. The dependency code is imported by the Skill’s scripts and executes with the invoking user’s privileges.

This path depends on compromise or unsafe changes in the upstream package ecosystem; no such compromise was established during the static audit.

Impact Assessment

A malicious dependency release could execute code with the privileges of the user running pip or the Skill. That could theoretically expose credentials, alter files accessible to that user, or modify API behavior.

Under ordinary conditions, the more likely impact is a future compatibility or reliability failure. The ab ...[truncated 82 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a reviewed exact version instead of using an unrestricted lower bound.
• Generate a lock file that includes all transitive dependencies.
• Require package hashes during installation, such as through a requirements file produced with pip-compile --generate-hashes.
• Review and periodically update pinned dependencies through a controlled process.
• Use a trusted package index and prevent unapproved index overrides in deployment environments.
• Run installation and the Skill under an unprivileged account or isolated virtual environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a data-query tool, but it also performs version checks, remote update lookups, and local cache file reads/writes. While less severe than credential or billing operations, these hidden side behaviors still expand network and filesystem access in ways not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is described as a data-query tool, but it also performs version checks, remote update lookups, and local cache file reads/writes. While less severe than credential or billing operations, these hidden side behaviors still expand network and filesystem access in ways not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a data-query tool, but it also performs version checks, remote update lookups, and local cache file reads/writes. While less severe than credential or billing operations, these hidden side behaviors still expand network and filesystem access in ways not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a data-query tool, but it also performs version checks, remote update lookups, and local cache file reads/writes. While less severe than credential or billing operations, these hidden side behaviors still expand network and filesystem access in ways not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading the entire ~/.upkuajing/.env file using cat, which exposes stored secrets beyond the single needed variable and normalizes direct credential access in the skill flow. In an agent setting, this can leak API keys or other environment secrets to logs, model context, or unintended outputs.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The instructions direct the workflow to inspect ~/.upkuajing/.env for an API key and, if absent, to obtain and automatically save a new key locally. This combines credential discovery, provisioning, and local persistence in a single skill, increasing the chance of secret exposure or unauthorized account linking.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly encourages writing user-provided or newly issued API keys into a local .env file. Plaintext local secret storage is risky because other tools, processes, or future runs may read or exfiltrate the credential, and the skill's declared purpose does not justify such broad secret-management behavior.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements API-key provisioning, account inspection, recharge-order creation, and pricing operations that are unrelated to the declared purpose of HS-code trade-share analysis. In a skill context, this capability mismatch is dangerous because it expands the effective permission and business-action surface to credential and billing functions users would not reasonably expect.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

This code reads an existing .env file to inspect whether an API key is already present. In context that is legitimate functionality, but storing and processing long-lived API credentials in a plaintext local file increases exposure risk if filesystem permissions are weak, the home directory is shared, or other tooling logs or syncs the file.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The function writes a newly issued API key directly into a .env file in plaintext. Plaintext local secret storage is risky because other local users, malware, backup/sync systems, or accidental inclusion in logs or repositories can expose the credential, enabling unauthorized API use.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Creating a recharge/payment order is a billing action with financial consequences and is not justified by the skill's stated analytics purpose. Hidden or unexpected monetization capabilities are especially risky in agent skills because invocation may trigger downstream charges or phishing-style payment flows without informed user expectation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements generic platform-side error reporting rather than the HS-code trade-share analysis behavior described in the skill manifest, indicating capability drift. In an agent skill context, undisclosed cross-skill telemetry increases risk because it can collect and transmit operational or user-derived data outside the user-expected function, making hidden data flows harder to audit.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares capabilities that include environment access, file reads/writes, and network interactions, but it does not define any explicit tool scope or permission boundaries. That increases the risk of overbroad execution, especially because the workflow includes credential handling, local file access, and external API calls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is written entirely in Chinese and all examples, prompts, and operating instructions assume Chinese-language use, but there is no statement that the skill is China/Chinese-specific or that users may choose another language. This can violate language/locale policy requirements when a skill implicitly mandates a language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly instructs reporting requestParams, responseData, and context containing stack traces or error details, while only vaguely stating that sensitive fields are 'automatically desensitized' and providing no concrete guidance on what must never be sent. In an agent/skill environment, these fields can easily contain user data, credentials, tokens, business data, or full model prompts, so this creates a real risk of unintended sensitive-data exfiltration through telemetry.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Provisioning new API keys is a credential-management feature outside the declared analytics scope. This increases the blast radius of the skill by allowing account bootstrap and persistent access setup, which can be abused for unauthorized service consumption or later misuse if the generated key is exposed.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The explicit require_auth=False setting disables authentication checks for the key-provisioning request. In a skill that should only perform trade-share queries, this broadens access to credential-issuing behavior and can facilitate unauthorized account creation or service abuse if backend protections are insufficient.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The explicit require_auth=False setting disables authentication checks for the key-provisioning request. In a skill that should only perform trade-share queries, this broadens access to credential-issuing behavior and can facilitate unauthorized account creation or service abuse if backend protections are insufficient.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The recharge-order function directly requests a payment URL without any user-facing warning, confirmation, or validation step. For billing-related operations, lack of an explicit consent checkpoint can lead to accidental financial actions and makes social-engineering or deceptive invocation easier.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196