Query paginated trade-area data for a company — retrieve country/region breakdowns withtrade counts, amounts, and percentages for market-analysis. Designed for customs dataresearch, paginated region queries, company trade country breakdowns, import-export marketanalysis and trade region drill-down across 220+ countries and territories.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

The skill performs its advertised customs data lookup, but it also includes account funding, credential storage, error-reporting, and an undisclosed version-check side effect that users should review before installing.

Install only if you are comfortable with this skill managing an UpKuaJing API key in a plaintext home-directory .env file, contacting UpKuaJing for queries and version checks, and offering account/billing actions such as recharge order creation. Confirm every fee-incurring query or top-up action deliberately, and avoid sending secrets or private business details in error-report context.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation directs use of environment variables, local file access to ~/.upkuajing/.env, network calls to multiple remote APIs, and local writes, yet no explicit permissions are declared. This creates a transparency and least-privilege problem: operators may invoke the skill expecting a simple data lookup while it can read/write credentials and perform additional remote actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a paginated company area query, but the skill also includes credential provisioning, account inspection, recharge order creation, pricing retrieval, error reporting, and version-check behavior. This mismatch is dangerous because it expands the operational scope into sensitive account and billing actions that a user may not reasonably expect from the stated description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key issuance, account-balance lookup, pricing lookup, and recharge-order creation, which are materially broader than the declared purpose of a company trade-area query skill. In an agent-skill context, hidden or unnecessary account and billing capabilities expand the attack surface and can enable unauthorized credential provisioning or financial actions if the skill is invoked unexpectedly or repurposed.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill can create recharge/payment orders even though its stated purpose is market-analysis querying. Billing functionality is especially sensitive because it can trigger financial workflows unrelated to user expectations, and in an agent ecosystem this mismatch increases the risk of abuse, accidental charges, or social-engineering of users into funding an account.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This module performs outbound network calls to a version endpoint and writes persistent state under the user's home directory, behavior unrelated to the skill's declared customs-area query function. While the code looks like ordinary update-check logic rather than overtly malicious behavior, hidden secondary communications and disk writes expand the trust boundary, create telemetry/privacy concerns, and introduce an unnecessary remote dependency that could be abused if the API base URL or update service is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill defines hidden self-update/cache infrastructure that is not justified by its market-analysis purpose. Even if intended for maintenance, embedding telemetry/update capability inside a business-data skill creates unnecessary side effects and can surprise operators who expect only trade-area queries.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger phrases are broad enough to match general analytical or market-analysis requests, increasing the chance of over-invocation outside a narrow customs-area context. In a fee-incurring skill with credential and network capabilities, overly broad routing raises the risk of unintended execution and unexpected charges or data access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function forwards a caller-supplied `context` field, along with request identifiers and path, to `/agent/skill/error/report` without any validation, redaction, or user-facing disclosure in this file. If upstream callers place sensitive prompts, business data, tokens, or personal data into `context`, this creates an avoidable data-leakage path to platform telemetry.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 96% confidence
• Finding: The skill explicitly instructs checking and using the local ~/.upkuajing/.env file for API credentials and can automatically create and save a new key there. Accessing and persisting secrets in a local dotfile increases the chance of credential exposure, unintended reuse across contexts, and unauthorized account actions if the skill or surrounding agent is compromised.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 96% confidence
• Finding: This section continues the credential-handling flow by directing the agent to inspect whether UPKUAJING_API_KEY exists and, if not, obtain and save one automatically. That combines credential discovery, provisioning, and local storage in a skill that is nominally for data queries, increasing the blast radius if abused.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 83% confidence
• Finding: Writing a newly issued API key to a plaintext .env file creates a persistent secret on disk that may be readable by other local users, backup systems, or downstream tooling if permissions are not tightly controlled. In a skill environment, automatic credential persistence is more dangerous because it can silently broaden who or what can later reuse the key.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only (`httpx>=0.23.0`), which allows future major or minor releases to be installed without review. This can introduce breaking changes or newly introduced vulnerable versions into the skill's environment, reducing build reproducibility and making supply-chain risk harder to control.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 80% confidence
• Finding: The explicit use of require_auth=False for '/agent/auth/create' codifies an unsafe default in the client: sensitive credential-issuance behavior is treated as exempt from authentication. Even if intended for onboarding, this normalizes insecure patterns and is mismatched with the skill's declared read-oriented functionality.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 80% confidence
• Finding: The explicit use of require_auth=False for '/agent/auth/create' codifies an unsafe default in the client: sensitive credential-issuance behavior is treated as exempt from authentication. Even if intended for onboarding, this normalizes insecure patterns and is mismatched with the skill's declared read-oriented functionality.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58