查询公司海关贸易区域列表数据 — 获取国家/地区的贸易次数、金额和占比，用于市场分析。支持全球 220 多个国家和地区的海关贸易数据。帮助外贸团队分析公司的贸易国家分布、计算各区域的市场占比、识别重点出口市场——是市场进入分析、客户分布研究和区域贸易情报的核心工具。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.1

Overview

This is a real paid customs-data API skill, but it handles API keys and account operations in ways users should review before installing.

Review this skill before installing. Only use it if you trust Upkuajing with the company-trade queries you submit and with account operations tied to the API key. Do not run the documented `cat ~/.upkuajing/.env` command in an agent session; verify key presence without printing the value. If you use the key-generation flow, restrict `~/.upkuajing` and `.env` permissions yourself, and treat recharge/payment URL creation as a user-confirmed billing action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Credential Exposure Through Documented Plaintext File Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-46
Vulnerability Type: Credential exposure
Risk Level: Medium

Vulnerable Code Snippet:

markdown

本技能需要API密钥。API密钥存储在 `~/.upkuajing/.env` 文件中：
```bash
cat ~/.upkuajing/.env

文件内容示例：

text

UPKUAJING_API_KEY=your_api_key_here

API密钥未设置

首先检查 ~/.upkuajing/.env 文件中是否有 UPKUAJING_API_KEY；

text

### Technical Analysis

The setup instructions recommend executing `cat ~/.upkuajing/.env`, which prints the entire credential file to standard output. Although accessing the designated API key is necessary for authenticated API calls, displaying its plaintext value is not necessary to verify whether it is configured.

In an AI Agent environment, command output may be copied into the current model context, conversation history, execution logs, terminal recordings, observability platforms, or debugging traces. The file could also acquire additional variables in the future, causing the command to expose more than the intended API key.

This behavior exceeds minimum privilege because a non-revealing presence check would be sufficient.

### Attack Path

1. An Agent or user follows the documented environment-check procedure.
2. The command `cat ~/.upkuajing/.env` is executed.
3. The plaintext API key appears in terminal output and potentially in Agent context or retained logs.
4. A party with access to those records extracts the key.
5. The exposed key is reused to access account APIs or invoke paid query endpoints.

### Impact Assessment

Exposure grants the attacker the same API privileges assigned to the key. Depending on the associated account, this may include:

- Performing paid API queries and consuming the account balance.
- Retrieving account-related information exposed by authenticated endpoints.
- Creating payment-order URLs or accessing other authenticated platform operations.
- Associating unauthorized activity w
...[truncated 175 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the complete .env file.

• Use a non-revealing check that reports only whether the variable exists, for example:

  bash

  python -c "import os; print('configured' if os.getenv('UPKUAJING_API_KEY') else 'not configured')"
  

• If checking the file fallback is required, parse only the variable name and return a Boolean result without printing its value.

• Redact API keys from command output, exceptions, telemetry, and Agent responses.

• Advise users to rotate the key immediately if it has already appeared in conversation history or logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:61

Finding

API Key Stored Without Explicit Owner-Only File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 61-74
Vulnerability Type: Insecure local secret storage
Risk Level: Medium

Vulnerable Code Snippet:

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

A newly issued API key is written to ~/.upkuajing/.env, but the code does not explicitly enforce owner-only permissions on either the containing directory or the credential file. Path.mkdir() and open(..., 'w') derive effective permissions from platform defaults and the process umask.

On a system with a permissive umask, inherited access-control entries, or an existing broadly accessible directory, another local user may be able to read the file. Existing files are truncated and rewritten without correcting their current permissions.

The designated credential path is functionally justified, but secure permissions are required because it contains a reusable bearer token.

Attack Path

1. A user invokes python scripts/auth.py --new_key.
2. The service returns a new bearer token.
3. The script writes the token to ~/.upkuajing/.env using default filesystem permissions.
4. A local user or process with access to the home directory reads the file where platform permissions allow it.
5. The attacker reuses the bearer token against authenticated Upkuajing endpoints.

Exploitation depends on local filesystem permissions and the presence of another untrusted local principal.

Impact Assessment

A successful attacker obtains the full API key and can exercise the associated API ac ...[truncated 395 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700 and verify or correct the mode if it already exists.
• Create the credential file atomically with mode 0600, rather than relying on the process umask.
• Refuse to use credential files owned by another user or writable by untrusted principals.
• Correct permissions on existing files before writing.
• Avoid following symbolic links when creating or replacing the credential file.
• Write to a securely created temporary file in the same directory, flush it, and atomically replace the target.
• Where available, prefer an operating-system credential store over a plaintext .env file.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Dependency Version Weakens Supply-Chain Reproducibility

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1; installation is instructed in SKILL.md, line 20
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code Snippet:

text

httpx>=0.23.0

The corresponding installation instruction is:

markdown

2. **安装依赖**：`pip install -r requirements.txt`

Technical Analysis

The lower-bound-only constraint permits the package resolver to install any future httpx release. No upper bound, exact version, lockfile, or package hashes are provided. Consequently, installations performed at different times may receive materially different code that was not part of the audited project.

This is not evidence that the current httpx package is malicious. The risk is that an unrestricted future release, compromised distribution artifact, or incompatible transitive dependency could enter the runtime through the documented installation procedure.

Attack Path

1. A user follows the documented pip install -r requirements.txt instruction.
2. The package resolver selects the newest version satisfying httpx>=0.23.0, including future unaudited releases.
3. A compromised or unsafe eligible package artifact is downloaded from the configured package index.
4. Package installation or runtime import executes the introduced code in the user's Python environment.
5. That code receives the privileges of the installing or executing user and may access the environment, API key, files, and network.

This path requires compromise or malicious publication in the dependency supply chain; no such compromise was observed in the audited project.

Impact Assessment

If an eligible dependency artifact were compromised, code could execute with the privileges of the Python process. This could expose UPKUAJING_API_KEY, alter API requests, read user-accessible files, or modify the local environment.

The present finding is a h ...[truncated 96 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specifically reviewed version.
• Generate a lockfile that also fixes all transitive dependency versions.
• Require cryptographic hashes for downloaded distributions where supported.
• Install dependencies in an isolated virtual environment under a non-privileged account.
• Periodically update pinned dependencies through a controlled review and security-testing process.
• Use a trusted package index and retain dependency provenance or software-bill-of-materials records.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected version-check and cache behaviors are unrelated to the stated function of retrieving customs region analytics and add unneeded network and local-write surfaces. Ancillary update logic can be abused for covert communications, tracking, or persistence in environments where the skill was only trusted for read-oriented business queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The detected version-check and cache behaviors are unrelated to the stated function of retrieving customs region analytics and add unneeded network and local-write surfaces. Ancillary update logic can be abused for covert communications, tracking, or persistence in environments where the skill was only trusted for read-oriented business queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected version-check and cache behaviors are unrelated to the stated function of retrieving customs region analytics and add unneeded network and local-write surfaces. Ancillary update logic can be abused for covert communications, tracking, or persistence in environments where the skill was only trusted for read-oriented business queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The detected version-check and cache behaviors are unrelated to the stated function of retrieving customs region analytics and add unneeded network and local-write surfaces. Ancillary update logic can be abused for covert communications, tracking, or persistence in environments where the skill was only trusted for read-oriented business queries.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This line directs access to a .env file containing an API key and shows a command that would reveal the full secret. Credential files are highly sensitive, and exposing them in command output or conversation history can lead to account compromise, unauthorized API usage, and billing abuse.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The workflow instructs checking for the presence of UPKUAJING_API_KEY in a local .env file and potentially writing user-provided secrets there. Handling secrets through ad hoc file inspection and modification inside a skill expands the attack surface and risks inadvertent disclosure, unsafe storage, or unauthorized overwrites.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This section continues the instruction to inspect and populate the local .env credential file, reinforcing a pattern of direct credential access within a skill whose stated purpose is analytics retrieval. In context, that makes the skill more dangerous because a seemingly simple market-analysis tool can pivot into secret handling without strong safeguards.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

该技能清单声明的用途是公司海关贸易区域列表查询与市场分析，但本文件实现的是平台认证管理、账户余额查询、充值订单创建和接口定价查询。虽然网络请求本身对查询型技能并不异常，但这些认证与计费管理操作属于独立的账户运维能力，不是区域贸易分析功能的直接实现细节。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The function manages API credentials via a local .env file, indicating plaintext secret handling on disk. If file permissions are weak, the host is shared, or the directory is synced/backed up, the API key can be exposed and used to access the upstream account or incur charges.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Reading an existing .env file to recover an API key confirms the credential is expected to persist in plaintext and be retrievable by local code. In a skill context that is supposed to perform data queries, embedding credential access logic increases the blast radius if the skill or environment is compromised.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The code writes the newly issued API key directly into a .env file in plaintext, which is a classic secret-at-rest exposure. An attacker with local access, malware, CI artifact access, or backup access could recover the key and impersonate the user or consume billable API resources.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The error path references manual environment-variable setup and returns the env file path, reinforcing insecure secret handling practices and disclosing local filesystem layout. While path disclosure alone is low severity, in combination with plaintext credential storage it aids operators in placing secrets in predictable, potentially exposed locations.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file's behavior does not match the declared skill purpose: instead of querying customs trade area data, it reports execution errors to a platform endpoint. This kind of capability mismatch is dangerous because it can hide undeclared data flows and create covert telemetry paths that operators or users would not expect from the manifest.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable capabilities involving environment access, file reads/writes, and network use, but does not declare any explicit tool scope or permission boundaries. This creates an overbroad trust surface where an agent may invoke sensitive operations without clear least-privilege constraints or user/auditor visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly direct reading the local API key file with cat ~/.upkuajing/.env but do not warn against exposing secret contents to the user or logs. In an agent setting, this can directly leak credentials, especially because the file may be echoed back in transcripts or mishandled by downstream tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file presents its description, status messages, and CLI help exclusively in Chinese, with no opt-in or alternative language support. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

new_key() 不仅向认证接口申请新密钥，还在本地创建目录并写入 .env 文件保存凭据。对一个声明为“查询公司海关贸易区域列表数据”的技能而言，底层鉴权可能是实现细节，但显式暴露密钥申请与本地凭据管理已超出其分析查询语义范围。

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

new_rec_order() 调用 /agent/auth/pay/url 创建充值订单，这是平台资金充值能力，而不是国家/地区贸易数据查询或市场分析所必需的能力。相对于该技能面向分析查询的 stated purpose，这种计费操作缺乏直接业务正当性。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The request helper sends arbitrary params to a third-party API and includes optional request/response logging that can persist full payloads and server responses to local log files. If logging is enabled or sensitive business data is passed in params, this can expose confidential trade, company, or account information without minimization, redaction, or user disclosure.

Content

No source excerpt is available for this finding.