Query import/export trade trends analysis — retrieve monthly import and export trend data for a specified HS code over recent months. Returns both export and import data with monthly breakdowns including trade counts, quantities, weights, amounts, buyer counts and seller counts. Designed for trade analysts, supply chain managers and market researchers who need to analyze trade trends for specific products over time, understand seasonal patterns, compare export versus import activity and monitor market dynamics across global customs data covering 220+ countries and territories.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:04 AM UTC
• Version: 1.0.1

Overview

This skill appears to be a legitimate paid customs-trend API client, but it handles API keys and optional error reports in ways users should review carefully before installing.

Install only if you are comfortable giving the skill access to an UpKuaJing API key and using paid API calls. Prefer setting the key through a secure environment secret rather than displaying ~/.upkuajing/.env, review any error report before sending it, and avoid including prompts, business-sensitive queries, API responses, or credentials in the report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly instructs use of environment variables, reads a local .env file, may write credentials to that file, and calls external APIs, but no permissions are declared. This creates a transparency and policy-enforcement gap: users and the platform cannot accurately assess or constrain the skill's access to secrets, local files, and network operations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation explicitly allows reporting `requestParams`, `responseData`, and free-form `context` to a central error-reporting API. Even though it states sensitive fields are 'automatically desensitized', it does not define what is redacted, does not prohibit secrets or personal data in stack traces, and provides no user-facing consent or minimization guidance. In a trade-analysis skill, request and response payloads may contain proprietary business queries, identifiers, or credentials accidentally embedded in errors, so this creates a realistic privacy and data-leakage risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script forwards a caller-supplied `context` field to a remote error-reporting endpoint, and the help text encourages passing raw exception/context strings. In an agent setting, error context can easily contain prompts, request contents, identifiers, API responses, or other sensitive data; sending that data off-box without an explicit minimization/redaction step creates a real privacy and data-exposure risk.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: The skill instructs checking and potentially exposing the contents of ~/.upkuajing/.env, which is a credential store containing the API key. Encouraging direct access to a secrets file increases the risk of secret disclosure to the model, logs, or user-visible output, and normalizes unsafe secret-handling practices.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 91% confidence
• Finding: The workflow tells the agent to inspect a local credential file and supports automatically saving newly issued API keys into ~/.upkuajing/.env. This combines credential discovery with file write behavior, increasing the chance of leaking, mishandling, or persisting secrets in insecure locations outside controlled secret storage.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 86% confidence
• Finding: The code writes a newly issued API key to a .env file without showing any permission hardening or atomic secure-creation semantics. If the file is created with permissive default permissions or in a shared environment, other local users or processes may read the credential and abuse the API account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer versions of httpx that have not been tested with this skill and could introduce breaking changes or newly disclosed security issues. While this is not an immediately exploitable flaw by itself, it weakens supply-chain reproducibility and can increase exposure if an unsafe upstream release is pulled in.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58