查询分析报告-进出口贸易趋势 — 按月度维度返回指定HS编码在最近数月内的进出口趋势数据，包含出口和进口的月度分解信息，涵盖贸易次数、数量、重量、金额、采购商数量和供应商数量。帮助贸易分析师、供应链经理和市场研究人员分析特定产品随时间变化的贸易趋势、了解季节性波动规律、比较出口与进口活动的变化趋势——覆盖全球220多个国家和地区的海关贸易数据，是趋势研判和市场动态监测的核心工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:04 AM UTC
• Version: 1.0.1

Overview

This skill is a paid trade-data API integration with disclosed credential, billing, recharge, and error-report support, but users should treat the stored API key and paid calls carefully.

Install only if you are comfortable using the Upkuajing paid API service. Confirm before any charged query or recharge flow, keep ~/.upkuajing/.env private because it may contain your API key, and avoid approving error reports that include secrets, customer data, or confidential trade details.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares itself as a trade-trend query tool, but its documented behavior requires environment-variable access, local file reads/writes, and network operations without an explicit permission model. This creates an overprivileged execution surface where a seemingly simple query skill can read secrets, modify local state, and contact external services, increasing the chance of unintended data exposure or abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the stated purpose of querying HS-code trade trends: it can provision API keys, inspect account information, create recharge orders, fetch pricing, report data to the platform, and write local files. This mismatch undermines informed consent and can trick users or host systems into authorizing credential, billing, and telemetry actions they would not expect from a read-only analytics skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication lifecycle and billing-related functions (API key issuance, account info, recharge orders, pricing) that are materially outside the declared purpose of a trade-trend query skill. Capability expansion is dangerous because users or hosts may grant trust based on the advertised narrow function, while the code can access and modify account state and bootstrap credentials.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Creating recharge/payment orders is unrelated to analyzing HS-code trade trends and introduces a financial action surface into a read-oriented analytics skill. In the skill context, hidden payment functionality is especially risky because it can trigger user confusion, unauthorized billing flows, or social-engineering-style misuse under the guise of analytics.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code can request a new API key and persist it locally, which is not necessary for a narrowly scoped trade-trend query skill as presented. In context, concealed credential bootstrap behavior increases trust-boundary risk because the skill can establish or alter access for backend services beyond the user’s expected interaction.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Account balance and pricing queries are ancillary account-management features that exceed the stated purpose of querying trade trend data. While less severe than payment creation, they still expand the accessible data surface and can expose account and billing information unexpectedly in a context where users expect only analytics output.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a generic platform error-reporting function that is unrelated to the declared skill purpose of HS-code trade trend analysis. This mismatch expands the skill’s capabilities beyond what users and reviewers would reasonably expect, creating a covert telemetry path that can transmit runtime data during failures.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code adds a secondary capability to send exception details to a platform endpoint, but that behavior is not justified by the skill’s stated business function. Undisclosed side-channel reporting is dangerous because it can exfiltrate operational details, request metadata, or user-provided content under the guise of error handling.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module makes outbound network requests to a server-controlled endpoint and writes persistent state under the user's home directory, even though the skill's declared purpose is trade-trend analysis. That creates unnecessary data flow and side effects outside the core function, increasing privacy, supply-chain, and trust-boundary risks if the endpoint is misconfigured, compromised, or used for telemetry.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file implements self-version discovery, remote version lookup, and local caching logic that is unrelated to answering HS-code trade trend queries. While not directly exploitive by itself, embedding update-tracking behavior inside a business-data skill expands the attack surface and can normalize covert update or telemetry behavior in a context where users would not expect it.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and error context to a centralized error-reporting API, but it does not require explicit user notice, consent, or strong minimization of what gets transmitted. Even though it mentions that sensitive fields are 'automatically desensitized,' requestParams, responseData, and stack/error context can still contain personal, commercial, or confidential data, creating a privacy and data-sharing risk if over-collected or improperly scrubbed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes the API key to a local .env file in the user directory without setting restrictive file permissions or using a secure secret store. If the file is readable by other local users, backed up broadly, or accidentally committed/shared, the credential can be stolen and used to access the associated service account.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The error-reporting request sends a caller-supplied 'context' field, along with request identifiers and paths, to an external platform endpoint without any indication of redaction, minimization, or user disclosure in this file. If context contains prompts, trade data, credentials, tokens, or internal stack details, this creates a direct sensitive-data leakage channel.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 98% confidence
• Finding: The skill instructs access to `~/.upkuajing/.env` to check for and potentially populate `UPKUAJING_API_KEY`, which is credential material. Reading or writing secret-bearing files from within a skill increases the risk of credential disclosure, unauthorized reuse, or accidental leakage through logs, prompts, or error flows, especially since the skill also includes network and reporting behaviors.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: The follow-on workflow explicitly supports obtaining a new key and automatically saving it into `~/.upkuajing/.env`, extending the credential-risk surface from read access to persistent write access. That persistence in a predictable user-home path can enable later unauthorized access by other tools, mishandling of multi-user environments, or secret exposure through backups and support artifacts.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: This line persists a newly issued API key to a plaintext .env file, creating a local credential exposure risk. In the context of a skill that was supposed to perform data analysis, silently establishing and storing credentials materially increases the danger because users may not expect secret material to be created on disk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is only lower-bounded (`httpx>=0.23.0`) and not pinned to an exact version or constrained range, which makes builds non-reproducible and can unexpectedly pull in newer releases with breaking changes or newly introduced supply-chain risk. While this is not an immediately exploitable code flaw by itself, it does increase exposure to malicious or vulnerable upstream packages over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196