查询分析报告-进出口贸易趋势 — 按月度维度返回指定HS编码在最近数月内的进出口趋势数据，包含出口和进口的月度分解信息，涵盖贸易次数、数量、重量、金额、采购商数量和供应商数量。帮助贸易分析师、供应链经理和市场研究人员分析特定产品随时间变化的贸易趋势、了解季节性波动规律、比较出口与进口活动的变化趋势——覆盖全球220多个国家和地区的海关贸易数据，是趋势研判和市场动态监测的核心工具。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

The skill supports the advertised trade-trend query, but it also handles API keys, account/billing actions, and an undisclosed version check that users should review before installing.

Install only if you are comfortable giving the skill access to a paid Upkuajing API account. Keep the API key out of chat output, review any recharge/payment URL before opening it, require separate confirmation for billable calls, and consider storing the API key with stricter local permissions than the skill enforces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes capabilities beyond its apparent simple query purpose, including reading environment variables, accessing local files, and making network requests, yet does not declare permissions. This weakens transparency and consent boundaries, making it easier for an agent to access secrets or modify local state without an explicit trust decision from the user.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a trade-trend lookup tool, but documentation instructs the agent to also handle API key provisioning, account inspection, recharge order creation, payment URL retrieval, pricing queries, and version caching. This description-behavior mismatch can mislead users into authorizing a data query skill that also performs credential, billing, and local state operations.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements API key issuance, account lookup, pricing lookup, and recharge-order creation, which materially exceeds the declared purpose of an HS-code trade-trend analysis skill. This kind of scope drift is dangerous because it introduces financial-account and credential-management capabilities into a data-query skill, increasing attack surface and enabling misuse if the skill is invoked unexpectedly or bundled into a broader agent workflow.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Creating recharge/payment orders is unrelated to trade-trend analysis and introduces a direct financial operation into the skill. If exposed through an agent or automation context, an attacker or prompt-injected workflow could trigger billable payment flows or socially engineer users into completing unintended transactions.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Account-balance and pricing functions are outside the declared analytical scope and expose operational and financial metadata. While not as severe as direct payment creation, they still expand the skill's privilege surface and may leak sensitive business information useful for reconnaissance or abuse planning.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module adds outbound network access and persistent local cache writes that are unrelated to the skill’s declared trade-trend analysis purpose. Even if intended for maintenance, hidden side-effecting behavior increases attack surface, creates undisclosed telemetry, and can be abused if the API base URL is influenced by an untrusted source or the remote endpoint is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill performs self-update/version telemetry by contacting a remote service and transmitting the skill name during normal operation, which is not justified by the business function of querying trade trends. This creates an unnecessary data flow and dependency on a remote service that could be used for tracking, fingerprinting installed skills, or serving misleading upgrade prompts.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The code sends the skill name to a remote API without any visible user-facing disclosure or consent. While the data is limited, it still reveals installed capability metadata and usage context, which may be sensitive in enterprise or regulated environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 94% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 86% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196