查询分析报告-贸易占比 — 按贸易量排名返回指定HS编码下各企业的贸易份额数据，包含贸易次数、占比、数量、金额和合作伙伴数量，支持出口国/进口国类型筛选和最近月数筛选。帮助贸易分析师、采购代理和市场研究人员识别特定产品的主要交易企业、分析市场集中度、评估供应商竞争格局并发现潜在贸易伙伴——覆盖全球220多个国家和地区的海关贸易数据，是市场集中度分析和竞争力评估的核心工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its trade-data purpose, but it also handles API keys, billing actions, error reports, and an under-disclosed version check, so users should review it before installing.

Install only if you are comfortable giving the skill access to a paid Upkuajing API account, storing the API key in a local plaintext file, and allowing provider network calls. Confirm any paid query, recharge order, or error report before it runs, and avoid sending raw prompts, secrets, or sensitive business data in error-report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly require access to environment variables, reading and writing files under the user's home directory, and making networked API calls. This mismatch weakens sandboxing and user consent because the runtime capabilities materially exceed what is declared in the skill manifest.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements authentication, API key provisioning, account inspection, pricing lookup, and recharge-order creation even though the advertised skill is only for HS-code trade-share analysis. This scope mismatch is dangerous because it grants billing and credential-management capabilities unrelated to the user-facing purpose, increasing the attack surface and enabling unexpected account or spending operations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script exposes a function that creates a recharge/payment order, which is a monetization action unrelated to querying trade-share data. In the context of an analysis skill, embedded payment initiation is risky because it can trigger unintended financial actions if invoked by an agent, wrapper, or confused operator.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code can request a new API key and persist it locally, which exceeds the direct needs of a simple analysis skill and creates credential lifecycle management behavior inside an otherwise data-querying package. This broadens privilege handling and can lead to unauthorized key issuance, accidental disclosure, or misuse of newly created credentials.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This module introduces outbound network communication to a remote version API and writes persistent state under the user's home directory, behavior that is not necessary for the stated trade-share analysis purpose. While the logic appears intended for update notification rather than direct compromise, the hidden side effect expands the skill's attack surface, creates undeclared data egress, and could be abused if the API base URL or remote service is untrusted or manipulated.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file contains self-update/version-notification behavior that is not reflected in the skill's declared analytics-only functionality. This mismatch is security-relevant because users and reviewers may approve a data-query skill without realizing it performs background telemetry-like requests and local persistence, undermining transparency and informed consent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs callers to upload request parameters, response data, and error context to an error-reporting endpoint, and notes only that sensitive fields will be auto-masked without defining scope or requiring user/operator review. In an agent skill context, these fields can easily contain business data, identifiers, prompts, or other confidential content, so broad telemetry collection creates a real risk of unintended data disclosure to the platform or logs.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script forwards a caller-supplied context field to a remote error-reporting endpoint without any minimization, redaction, or explicit user-facing disclosure. In an agent environment, error context can easily contain prompts, request metadata, identifiers, or business data, so this creates a realistic risk of unintended sensitive-data disclosure to the platform.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The version check sends the skill name to a remote API in the background without any explicit disclosure or confirmation flow. The transmitted data is limited, but the undisclosed request still constitutes unnecessary metadata leakage and can reveal installed capabilities or usage context to an external service.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 90% confidence
• Finding: The skill instructs the agent to inspect `~/.upkuajing/.env` for an API key and to manage credentials through that file. Encouraging direct access to a local secrets file creates a credential-exposure path: an overprivileged agent could read, disclose, or mishandle the secret beyond what is necessary for the task.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 88% confidence
• Finding: This section tells the user to manually add a provided API key into `~/.upkuajing/.env` and notes that tooling will auto-save new keys there. While not overtly malicious, it normalizes storing and handling credentials in a plain local file that the skill also references, increasing the chance of accidental disclosure, overwrite, or unauthorized reuse by the agent or other processes.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 90% confidence
• Finding: The script reads an existing .env file to locate and process an API key in plaintext. Plaintext secret handling in local files is dangerous because keys may be exposed through weak filesystem permissions, backups, logs, or other local access paths.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 98% confidence
• Finding: The code writes a newly issued API key directly into a .env file in plaintext. Persisting credentials this way is dangerous because anyone with local file access, backups, or accidental disclosure of the file can recover the secret and use the associated account or API privileges.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows newer unreviewed versions to be installed during future builds. This can introduce breaking changes or newly introduced vulnerable releases through supply-chain drift, reducing reproducibility and making security validation unreliable.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 87% confidence
• Finding: The explicit require_auth=False setting disables authentication for the key-creation request, creating a permissive default for a sensitive operation. In the context of a read-oriented analysis skill, this is especially concerning because the package can perform privilege-establishing actions without prior trust validation.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 87% confidence
• Finding: The explicit require_auth=False setting disables authentication for the key-creation request, creating a permissive default for a sensitive operation. In the context of a read-oriented analysis skill, this is especially concerning because the package can perform privilege-establishing actions without prior trust validation.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196