查询公司海关贸易区域列表数据 — 获取国家/地区的贸易次数、金额和占比，用于市场分析。支持全球 220 多个国家和地区的海关贸易数据。帮助外贸团队分析公司的贸易国家分布、计算各区域的市场占比、识别重点出口市场——是市场进入分析、客户分布研究和区域贸易情报的核心工具。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a paid customs-data query workflow, but it needs review because it stores API keys in plaintext, can create recharge/payment orders, and performs an under-disclosed version check.

Install only if you are comfortable with this skill contacting UpKuajing APIs, charging for API calls after confirmation, storing an API key in `~/.upkuajing/.env`, and using helper commands that can inspect account balance or create a recharge payment URL. Review the local `.env` file permissions and avoid running recharge or new-key commands unless you explicitly requested them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to use environment variables, read a local .env file, write credentials to disk, and make networked API calls, yet it declares no permissions. This creates a transparency and policy-enforcement gap: users and hosting systems cannot accurately assess or constrain what the skill will access before execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is a company customs area-list query, but the skill also includes account creation, credential provisioning, account/balance inspection, payment order creation, pricing queries, and local version/cache behavior. This hidden expansion of scope is dangerous because a user invoking a data-query skill may unintentionally trigger account-management or billing-related actions beyond the advertised function.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements account management, API key provisioning, recharge-order creation, and pricing lookup, which are materially unrelated to the declared customs area-list analytics purpose. Such scope expansion increases attack surface and enables billing/account actions that a user invoking a market-analysis skill would not reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create recharge/payment orders via /agent/auth/pay/url, which is a financial action unrelated to customs market-analysis queries. If exposed through an agent workflow, this could trigger unintended billing flows or facilitate social-engineering around payments.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script provisions new API credentials and persists them locally, despite the skill being described as an area-list analytics tool. Unnecessary credential lifecycle management broadens privilege exposure and can lead to credential misuse or accidental disclosure.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The module performs outbound network access and persistent local file writes for version checking, which is unrelated to the skill's declared customs/market-analysis function. Even if intended for maintenance, this expands the skill's behavior beyond user expectations, creates telemetry about installed skills, and introduces an unnecessary external dependency and data flow that could be abused or fail insecurely.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This code sends the skill name to a remote API to check for updates, which is effectively telemetry/self-update behavior not justified by the skill's stated purpose. In this context, that hidden communication is risky because a data-query skill should not silently contact external infrastructure unrelated to its core function.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code writes a newly issued API key into a local .env file automatically. Although the success message later mentions safeguarding the key, there is no explicit consent or security control at the moment of persistence, increasing the risk of secrets being stored in insecure locations, backed up, or exposed to other local processes/users.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 87% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: httpx>=0.23.0

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: auth=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: require_auth=False

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196