查询公司海关贸易区域维度统计数据 — 分析贸易量、金额、月度趋势和国家分布，覆盖全球市场。支持 220+ 国家和地区的海关数据。帮助外贸团队进行区域贸易分析、跟踪公司进出口国家分布变化、发现新兴市场机会——是贸易情报监测、供应商市场覆盖分析和全球贸易趋势研究的重要工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:42 AM UTC
• Version: 1.0.1

Overview

This is a disclosed paid API integration for customs trade statistics, with credential and billing helpers that users should handle carefully.

Install only if you are comfortable using the UPKUAJING paid API. Confirm charges before queries, store the API key carefully because it is written to a plaintext .env file, and review any error-report context before allowing it to be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior clearly requires environment access, local file read/write, and network operations. This creates a transparency and consent gap: a caller may invoke a seemingly simple data-query skill without understanding that it can inspect local credential files, persist secrets, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is trade-area statistics lookup, but the skill also handles API key creation/storage, account inspection, recharge order creation, pricing queries, and exception reporting. This mismatch increases risk because users and orchestrators may approve the skill for narrow analytics while it actually performs billing, credential, and external-reporting actions with materially different security and privacy implications.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication lifecycle and payment-related operations even though the declared skill is for customs/trade area statistics. This scope mismatch is dangerous because it introduces credential issuance, account inspection, and billing capabilities that users would not reasonably expect from an analytics skill, expanding the attack surface and enabling abuse of external accounts or funds.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Creating recharge orders and returning payment URLs is unrelated to the advertised customs area statistics purpose. In this context, payment initiation functions can be abused for unauthorized billing workflows or phishing-like redirection to payment pages under the guise of analytics tooling.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill can request a new API key and persist it locally, which is broader than necessary for a trade-statistics skill. Bundling credential enrollment into an unrelated skill increases the chance of silent credential sprawl, misuse of issued keys, and user confusion about what permissions are being granted.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly encourages sending raw request parameters, response data, and error context to a central reporting API, and only states that sensitive fields will be 'automatically desensitized' without defining scope, guarantees, or user/operator consent. In an error-reporting path, these fields commonly contain personal data, credentials, trade data, or internal stack traces, so silent transmission can create unintended data exposure and compliance risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code sends `requestId`, `requestPath`, and especially free-form `context` to a remote `/agent/skill/error/report` endpoint without any visible minimization, redaction, or user notice. If `context` contains stack traces, user prompts, business data, credentials, or other sensitive content, this creates an unbounded telemetry exfiltration path to the platform and can leak data outside the skill's stated customs-analysis purpose.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs reading `~/.upkuajing/.env` to check for `UPKUAJING_API_KEY` and supports writing new credentials into that file. Accessing and modifying local secret stores is sensitive because it exposes credential material to the skill path and creates risk of unauthorized disclosure, misuse, or persistence of secrets beyond the user's expectations.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: The same section continues to direct interaction with `~/.upkuajing/.env`, including manual insertion of user-provided keys and automatic saving of newly issued keys. In this skill context, that is especially risky because the skill is nominally a trade-statistics query tool, so credential-management behavior is unexpected and broadens the blast radius if the skill is misused or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 84% confidence
• Finding: The code reads an existing .env file and parses out an API key. While intended for local management, this is still credential handling in plaintext and increases exposure risk if file permissions are weak, logs/errors leak content, or the broader skill behavior is abused in an unexpected context.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key directly into a plaintext .env file. Plaintext persistence of active credentials materially increases the risk of credential disclosure through local compromise, backups, accidental commits, or other tools that routinely inspect .env files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows future unreviewed versions to be installed. This can introduce supply-chain risk through breaking changes or newly introduced vulnerable releases, and it reduces build reproducibility. In this skill, which likely performs external HTTP requests for trade/statistics retrieval, a compromised or incompatible HTTP client library could affect request handling, data integrity, or runtime stability.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196