查询公司海关贸易区域维度统计数据 — 分析贸易量、金额、月度趋势和国家分布，覆盖全球市场。支持 220+ 国家和地区的海关数据。帮助外贸团队进行区域贸易分析、跟踪公司进出口国家分布变化、发现新兴市场机会——是贸易情报监测、供应商市场覆盖分析和全球贸易趋势研究的重要工具。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.1

Overview

This skill performs the advertised trade-statistics queries, but it handles API keys and billing-related actions in ways users should review carefully before installing.

Install only if you are comfortable giving the skill access to an Upkuajing API key and paid account functions. Do not print or paste the contents of `~/.upkuajing/.env`; use a redacted presence check or platform secret storage instead, restrict the file to owner-only permissions, and treat recharge-order and exception-reporting actions as operations that need explicit review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

API Key Exposed Through Documented Shell Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API Key File Created Without Explicit Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Security-Sensitive HTTP Dependency Is Not Fully Pinned

Content

View full analysis

=0.23.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version. Package installation may therefore resolve to any future `httpx` version and to unreviewed versions of its transitive dependencies. This weakens build reproducibility and expands supply-chain exposure. The dependency is particularly security-sensitive because it handles the Bearer credential and all external API traffic. No malicious package, typo-squatted package, or untrusted package repository was identified in the audited project. The risk arises from allowing future, unreviewed versions to be installed automatically. ### Attack Path 1. A user installs the project dependencies at a later date. 2. The package resolver selects a newer, unreviewed `httpx` release or transitive dependency. 3. That release is compromised, incompatible, or introduces unsafe behavior. 4. The dependency executes with the privileges of the Skill process. 5. A compromised dependency could access the in-memory API key, inspect request data, alter responses, or perform additional network activity. ### Impact Assessment A malicious dependency would execute with the same operating-system privileges as the user running the Skill. It could potentially access files available to that user, including the API key, and intercept all API requests and responses. The current audit found no evidence that the resolved dependency is malicious. This is a preventative supply-chain and reproducibility finding rather than evidence of an active compromise. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's documented purpose is analytics, yet it also instructs the agent to perform exception reporting with request identifiers and contextual metadata to the platform. Hidden telemetry/reporting behavior expands data flows beyond the user's apparent request and may leak operational or user-related context to a third party.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's documented purpose is analytics, yet it also instructs the agent to perform exception reporting with request identifiers and contextual metadata to the platform. Hidden telemetry/reporting behavior expands data flows beyond the user's apparent request and may leak operational or user-related context to a third party.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's documented purpose is analytics, yet it also instructs the agent to perform exception reporting with request identifiers and contextual metadata to the platform. Hidden telemetry/reporting behavior expands data flows beyond the user's apparent request and may leak operational or user-related context to a third party.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly instructs reading a credential file from the user's home directory using a shell command. Encouraging direct access to ~/.upkuajing/.env exposes secrets to the agent runtime and creates a clear path for accidental disclosure, logging, or misuse of the API key.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill directs the workflow around checking for a secret in a local .env file and automatically saving newly created API keys there. This normalizes local secret handling by the agent and increases the risk of unauthorized file writes, insecure storage, or exposing credentials across sessions and tools.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill asks the agent to determine whether UPKUAJING_API_KEY exists in a local secret file and supports user-supplied insertion into that file. In the context of an agent skill, credential discovery and modification are especially sensitive because they can expose secrets, persist attacker-influenced values, or enable later unauthorized API usage.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file implements API key provisioning, account lookup, and payment-related actions even though the skill is presented as a trade-area statistics/analysis capability. This capability mismatch increases the risk of deceptive scope, unexpected credential handling, and financial operations being exposed to users or agents that only expected data-query behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The code writes a newly issued API key into a plaintext .env file under the user directory, which can expose credentials to other local processes, backups, or accidental disclosure if file permissions are weak. In an agent-distributed skill, persisting secrets this way without explicit permission hardening is risky because the skill also reaches out to remote account and payment endpoints.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating recharge/payment orders is a financial operation unrelated to customs-area statistics and materially expands the attack surface. In an agent skill context, unexpected payment initiation can enable abuse, user confusion, or unauthorized monetization workflows if invoked by mistake or through prompt/automation chaining.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares executable behaviors that can access environment variables, local files, and remote services, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that a host agent invokes the skill with broader capabilities than users expect, enabling unintended credential exposure, filesystem access, or network actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file declares invocation triggers in the description, and several phrases such as “区域贸易分析”, “全球贸易情报”, and “供应商市场覆盖” are broad natural-language expressions rather than narrowly scoped commands. Because the trigger list does not define boundaries or negative examples, the skill may be invoked for ordinary trade-analysis requests beyond this specific customs company area stats function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly instructs callers to transmit request parameters, response payloads, and exception context to an error-reporting endpoint. Even though it states that sensitive fields are 'automatically desensitized,' it does not define the redaction scope, guarantee complete coverage, or warn operators not to include secrets, personal data, or proprietary business data in free-form fields such as context. In a trade/customs analytics skill, these payloads may contain commercially sensitive shipment details, identifiers, or operational metadata, creating a real data leakage risk through telemetry.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural language entirely in Chinese, including the module description and command help text, with no indication that language is configurable or region-limited. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Account information and pricing queries are outside the reasonable functional scope of a trade-statistics skill and expose administrative/business metadata to callers. While less severe than payment creation, this still violates least functionality and can leak sensitive operational details or facilitate enumeration of the service account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module title and all user-facing messages/comments in this file are written only in Chinese, which effectively imposes a specific language on users and maintainers. Under the stated policy, a language restriction should either offer user choice or be clearly documented as a justified region-specific constraint, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The overall skill manifest claims the skill queries customs trade regional statistics and analyzes global market coverage. In contrast, this file's code and module docstring are dedicated to reporting agent/skill invocation exceptions to a platform service, which does not perform any customs-company-area statistical query or analysis behavior.

Content

No source excerpt is available for this finding.