Query paginated trade-area data for a company — retrieve country/region breakdowns withtrade counts, amounts, and percentages for market-analysis. Designed for customs dataresearch, paginated region queries, company trade country breakdowns, import-export marketanalysis and trade region drill-down across 220+ countries and territories.

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

This is a paid customs-data query skill with disclosed API-key and billing helpers, but users should understand it stores a key locally and can create top-up/payment orders after confirmation.

Install only if you are comfortable with a paid third-party API skill that stores its API key in ~/.upkuajing/.env, contacts UpKuaJing services, and may guide you through account top-up. Confirm costs before queries or top-ups, protect the .env file, and prefer an environment variable or secret manager if available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares only environment requirements but its documented behavior requires broader capabilities: reading and writing ~/.upkuajing/.env, invoking scripts that make network requests, and managing local files. This mismatch weakens permission transparency and can cause users or tooling to approve a skill without understanding that it can access credentials, modify local state, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a market-analysis query tool, but the documentation also instructs the agent to perform account creation, credential storage, account/balance lookup, recharge order creation, pricing queries, version checks, and local state management. That scope expansion is dangerous because users may authorize a seemingly read-only data query skill that can also initiate financial/account actions and handle secrets.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements API key issuance, account inspection, recharge order creation, and pricing lookup, which are outside the declared purpose of a company trade-area listing skill. In an agent-skill ecosystem, unrelated credential and billing functionality materially expands attack surface and enables unauthorized account provisioning or financial actions if the skill is invoked unexpectedly or repurposed.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Embedding credential provisioning and billing capabilities in a market-analysis skill violates least functionality and creates a dangerous mismatch between user expectations and actual behavior. Even if intended for convenience, such hidden operational capabilities can be abused to create keys, inspect accounts, or initiate payment workflows in contexts where only read-only trade analysis should exist.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This module introduces outbound network/version-management behavior that is unrelated to the declared trade-area query purpose of the skill. Even though the request appears limited to version checking, it creates an extra communication path, exposes execution metadata (skill name, usage timing), and expands the attack surface if the base URL is misconfigured or controlled by an attacker.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file's behavior does not match the manifest's stated market-analysis/query functionality, which is a meaningful security concern because hidden or undeclared capabilities reduce transparency and bypass user expectations. A skill that silently performs local file reads/writes and network calls outside its advertised purpose can be abused for covert telemetry or policy evasion even if the present implementation looks operationally benign.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 84% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 86% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: httpx>=0.23.0

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 83% confidence
• Finding: auth=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 83% confidence
• Finding: require_auth=False

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58