查询公司海关贸易区域维度统计数据 — 分析贸易量、金额、月度趋势和国家分布，覆盖全球市场。支持 220+ 国家和地区的海关数据。帮助外贸团队进行区域贸易分析、跟踪公司进出口国家分布变化、发现新兴市场机会——是贸易情报监测、供应商市场覆盖分析和全球贸易趋势研究的重要工具。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

This is a disclosed paid API query skill with support helpers for API keys, pricing, account info, and recharge orders; the main caution is local plaintext credential storage.

Before installing, understand that this skill calls a paid external API, stores or reads UPKUAJING_API_KEY from ~/.upkuajing/.env, can show account balance/pricing, and can create recharge payment URLs. Confirm paid queries only when you intend to spend credits, avoid displaying the API key value, and consider tightening permissions on the local .env file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares only runtime requirements but no explicit permissions, while its documented behavior includes reading environment secrets, reading and writing files under the user's home directory, and making network requests. This under-declaration weakens user consent and review controls, making sensitive operations easier to trigger without clear disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a trade-statistics query tool, but its instructions also cover credential provisioning, local secret storage, account inspection, pricing queries, and payment/recharge order creation. This description-behavior mismatch is dangerous because users may invoke a seemingly read-only analytics skill without realizing it can manipulate credentials, persist secrets locally, and initiate billable or payment-related workflows.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script adds API key issuance, account inspection, and payment-related capabilities to a skill whose declared purpose is customs/trade area statistics. This scope mismatch is dangerous because it expands the skill from read-oriented analysis into credential provisioning and billing operations, increasing attack surface and enabling unintended account actions if the skill is invoked or distributed in broader contexts.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Creating recharge/payment orders is unrelated to regional trade statistics and introduces transactional side effects into an otherwise data-query skill. If exposed through an agent workflow, this could be abused to trigger unwanted billing actions or socially engineer users into completing payments through generated URLs.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Account balance and API pricing queries reveal operational and financial metadata that is not necessary for company customs-area statistics. This broadens the data exposure surface and may leak commercially sensitive account information to users or workflows that were only expected to perform trade analysis.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The logging helpers write full request parameters and full API responses to local log files when enabled, which can capture sensitive business data, identifiers, or returned records without redaction. In a trade-intelligence skill, those payloads may contain commercially sensitive query terms or results, creating unnecessary local data exposure if logs are accessed by other users or processes.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The code transmits the locally installed skill name to a remote API as part of an automatic version-check workflow, but there is no user-facing notice, consent, or clear opt-out in this module. While the data sent is limited, it still leaks local tool usage metadata to a server and can surprise users in environments with privacy, compliance, or strict network-egress requirements.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 98% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: httpx>=0.23.0

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196