查询分析报告-进出口贸易趋势 — 按月度维度返回指定HS编码在最近数月内的进出口趋势数据，包含出口和进口的月度分解信息，涵盖贸易次数、数量、重量、金额、采购商数量和供应商数量。帮助贸易分析师、供应链经理和市场研究人员分析特定产品随时间变化的贸易趋势、了解季节性波动规律、比较出口与进口活动的变化趋势——覆盖全球220多个国家和地区的海关贸易数据，是趋势研判和市场动态监测的核心工具。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill’s trade-query purpose is mostly coherent, but it handles API keys, billing flows, telemetry, and hidden version-check persistence in ways users should review carefully before installing.

Install only if you are comfortable with a Chinese-language skill that calls Upkuajing APIs, may incur per-query fees after confirmation, stores its API key in a local plaintext file, can create recharge payment URLs, and can report errors to the platform after confirmation. Do not run the documented cat command on the .env file or paste API keys into chat/logs; prefer setting UPKUAJING_API_KEY through a secure environment/secret mechanism and restrict local file permissions if you use the .env flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Documentation Instructs the Agent to Print the API Credential File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:68

Finding

API Key File Is Created Without Explicit Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party HTTP Dependency Is Not Reproducibly Pinned

Content

View full analysis

=0.23.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version. As a result, the documented installation process can resolve any future `httpx` release accepted by the package resolver. This prevents reproducible dependency installation and means future, unreviewed releases may be installed automatically. A later release could introduce incompatible behavior, a security regression, or—in the event of an upstream package or package-index compromise—malicious code. No evidence was found that the current `httpx` package name is typosquatted or malicious; this finding concerns uncontrolled future resolution rather than a confirmed malicious dependency. The requirements file also lacks integrity hashes, so the installer does not verify that it received a specifically reviewed artifact. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` procedure. 2. The package resolver selects the newest available version satisfying `>=0.23.0`. 3. A future compromised, malicious, or incompatible release is selected without a project change or review. 4. Package code executes during import or affects HTTP request processing at runtime. 5. Depending on the upstream compromise, it could access process data, including the API credential, or alter requests and responses. This path depends on a malicious or vulnerable future upstream release or compromise of the package distribution channel; no such compromise was established during this audit. ### Impact Assessment A compromised dependency executes with the privileges of the user running the Skill. It could potentially read files available to that user, access environment variables and API credentials, modify network traffic, or alter local data. Because exploitat ...[truncated 168 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes version-check behavior, local parsing of SKILL metadata, cache writes in the home directory, and upgrade prompting despite being advertised as a trade-query skill. Hidden maintenance/network behavior broadens the trust boundary and can leak metadata or create persistent artifacts unrelated to the user-requested task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill includes version-check behavior, local parsing of SKILL metadata, cache writes in the home directory, and upgrade prompting despite being advertised as a trade-query skill. Hidden maintenance/network behavior broadens the trust boundary and can leak metadata or create persistent artifacts unrelated to the user-requested task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes version-check behavior, local parsing of SKILL metadata, cache writes in the home directory, and upgrade prompting despite being advertised as a trade-query skill. Hidden maintenance/network behavior broadens the trust boundary and can leak metadata or create persistent artifacts unrelated to the user-requested task.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes version-check behavior, local parsing of SKILL metadata, cache writes in the home directory, and upgrade prompting despite being advertised as a trade-query skill. Hidden maintenance/network behavior broadens the trust boundary and can leak metadata or create persistent artifacts unrelated to the user-requested task.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill instructs reading the full ~/.upkuajing/.env file, which may expose the API key and potentially other secrets stored in that file. In an agent environment, encouraging raw secret-file access increases the chance of credential disclosure to logs, transcripts, or unintended downstream processing.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The workflow instructs users or the agent to add credentials into a local plaintext .env file and notes that auth.py --new_key will auto-save the new secret there. Storing and managing API credentials in a writable plaintext file under the home directory creates credential theft risk from other processes, logs, backups, or overly broad file access.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This section repeats the practice of checking and populating ~/.upkuajing/.env with API secrets, reinforcing a pattern of direct credential-file handling inside a trade-analysis skill. The skill context makes this more dangerous because credential management is unnecessary for the advertised narrow task and enlarges the blast radius if the agent is induced to inspect or modify local secret files.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements API key issuance, account lookup, recharge-order creation, and pricing queries, which are materially unrelated to a skill described as read-only trade trend analysis. In an agent-skill context, this expands capabilities into credential provisioning and billing flows, increasing attack surface and enabling unexpected side effects a user would not reasonably expect from the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Writing an API key into a .env file stores a credential in plaintext on disk, which increases the chance of local disclosure through weak permissions, backups, accidental commits, or other tools reading environment files. In a skill that users expect to analyze trade data, hidden credential storage is more dangerous because it is outside normal expectations.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating recharge orders and exposing payment-related endpoints is unjustified for a trade-analysis/query skill and introduces financial side effects. If an agent can invoke this unexpectedly, users may be pushed into unintended billing workflows or payment links outside the skill's stated purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring explicitly describes cross-platform agent exception reporting, which contradicts the stated purpose of a trade analytics skill. This kind of hidden secondary purpose increases risk because it signals undeclared telemetry or data transfer functionality that operators may not review under the expected trust boundary of the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements exception reporting to a platform endpoint instead of HS-code trade trend querying described by the manifest, creating a clear capability mismatch. In an agent skill, undocumented out-of-scope network functionality is dangerous because it can exfiltrate operational context and makes the skill behave differently from what integrators and users expect.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool or permission boundaries even though the documented behavior includes reading environment files, writing local configuration, and making external network requests. In an agent setting, this expands the effective attack surface and makes it harder to constrain what the skill may access or modify at runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown skill file presents its operational instructions, warnings, and usage examples only in Chinese. Under the policy, forcing a specific language without user opt-in or a clearly justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The API documentation instructs agents to upload request parameters, response payloads, and exception context to a central error-reporting endpoint. Even though it says sensitive fields are 'automatically desensitized,' it provides no explicit data classification rules, user notice, consent flow, or prohibition on including secrets, personal data, or commercially sensitive trade data in free-form fields such as context, requestParams, and responseData. In this skill context, debugging data may contain user queries, HS codes, business analysis inputs, and backend error details, increasing the chance of unintended data leakage to logging or telemetry systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s user-facing description, error messages, and CLI help are presented only in Chinese, with no mechanism to select another language or indication that the tool is intentionally region-specific. Under the policy, forcing a language/locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196