查询公司海关贸易区域列表数据 — 获取国家/地区的贸易次数、金额和占比，用于市场分析。支持全球 220 多个国家和地区的海关贸易数据。帮助外贸团队分析公司的贸易国家分布、计算各区域的市场占比、识别重点出口市场——是市场进入分析、客户分布研究和区域贸易情报的核心工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

This skill appears to perform the advertised paid customs-area lookup, but it also handles raw API keys, account/payment actions, error reporting, and an automatic version check with local persistence that deserve review before installation.

Install only if you are comfortable with this provider handling paid customs-data API calls, local plaintext storage of UPKUAJING_API_KEY, account balance lookups, recharge-order creation, diagnostic reports after confirmation, and automatic version-check calls to the provider. Avoid pasting or displaying the API key, review any error report before sending it, and initiate recharge flows only when you explicitly intend to pay.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises executable capabilities that include environment access, file read/write, and network use, but does not declare equivalent permissions or clearly bound them. This creates a transparency and least-privilege problem: users and hosting systems may authorize a seemingly simple data-query skill without realizing it can access local secrets, modify files, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a trade-area lookup skill, but the behavior extends into account management, billing, key issuance/storage, error reporting, and version/cache activity. That mismatch is dangerous because users may invoke a benign-seeming analytics skill that can trigger sensitive account operations, exfiltrate operational metadata, or modify local state beyond the expected scope.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication, API-key issuance, account lookup, pricing lookup, and recharge-order creation, which does not align with the declared purpose of a customs-area analytics skill. In a skill ecosystem, this kind of scope mismatch is dangerous because it expands the operational surface to billing and credential management, increasing the chance of unauthorized charges, credential sprawl, or hidden monetization workflows.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Creating recharge orders is unrelated to the stated market-analysis function and introduces a payment workflow into a data-query skill. That increases user risk because a seemingly analytical skill can trigger monetization actions that may be unexpected or socially engineered.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script is broadly focused on API key issuance, account information, pricing, and billing operations rather than the declared customs-area-list analytics use case. This kind of overbroad capability is dangerous because users invoking a data-analysis skill may unknowingly expose themselves to account and payment side effects outside the expected trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module introduces behavior outside the skill’s declared customs/trade-analysis purpose: it performs outbound network requests and writes persistent local state under the user’s home directory. While the code appears intended for version checking rather than overtly malicious activity, undeclared side effects expand the trust boundary, create telemetry and privacy concerns, and increase the attack surface if the remote endpoint or api_base_url is misconfigured or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill’s stated purpose is querying customs company area data, but this code adds self-update/version telemetry functionality that is not necessary for that business function. Such hidden auxiliary behavior can surprise users, leak installation metadata, and be abused as a control channel if the backend or configuration is attacker-controlled.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly supports sending request parameters, response data, and error context to a centralized error-reporting API. Even though it mentions automatic masking of sensitive fields, it does not require user warning, consent, minimization, or strict redaction before transmission, so debugging payloads may disclose proprietary business data, personal data, tokens, or internal system details to the platform side.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function forwards a caller-supplied context field to a remote error-reporting endpoint without any minimization, redaction, or user-facing notice. If exception context includes request contents, identifiers, business data, or secrets, this can leak sensitive information to backend logs or monitoring systems beyond the user's expectation.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The version-check request sends the skill name to a remote service without any user-facing disclosure or confirmation. Although the transmitted data is limited, it still reveals installed skill metadata and usage context, which is unnecessary for the core customs-query function and can contribute to tracking or inventorying user environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs reading a credential file from ~/.upkuajing/.env and managing API keys through local file storage. Accessing or encouraging handling of raw secret material in a general-purpose skill increases the risk of credential disclosure, unauthorized reuse, or leakage through logs, prompts, or other chained tooling.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: This section explicitly directs the workflow around checking and populating ~/.upkuajing/.env with API key material, including automatic local persistence of newly issued keys. That expands the attack surface for credential theft and persistence on the host, especially because the skill also has file and network capabilities and performs non-query account actions.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 87% confidence
• Finding: The code reads an existing .env file containing API credentials and later includes part of the key in user-visible output. Storing and handling secrets in plain text increases exposure risk, especially on multi-user systems or where file permissions are weak, and any echoing of key material unnecessarily increases leakage risk.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 93% confidence
• Finding: The script writes a newly issued API key to a plain-text .env file without showing any permission hardening or secure storage controls. Plain-text local secret storage is dangerous because any local compromise, backup leak, or permissive filesystem setting can disclose the credential and enable unauthorized API use or billing abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.23.0), which permits installation of any future major or minor release. This can lead to unpredictable builds, accidental introduction of vulnerable or incompatible versions, and weaker supply-chain control over time. In this skill, which appears to perform external HTTP-based data retrieval, the risk is somewhat more relevant because the networking library is security-sensitive infrastructure.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196