Query company customs trade statistics by region dimension — analyze trade volume, amount,monthly trends, and country distribution across global markets. Perfect for regional tradeanalysis, company import-export country distribution, global trade intelligence, supplier marketcoverage assessment and cross-border market trend monitoring.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:58 AM UTC
• Version: 1.0.1

Overview

This is a disclosed paid API integration for customs statistics, with API-key storage, billing helpers, and opt-in error reporting that fit the stated service model but need careful handling.

Install only if you intend to use UpKuaJing's paid API. Confirm charges before running queries, keep ~/.upkuajing/.env private, avoid sharing API-key contents in chat or logs, and review any error report context before allowing it to be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require environment access, reading and writing files under ~/.upkuajing, and making networked API calls. This hidden capability expansion weakens reviewability and informed consent, because operators may approve a seemingly simple analytics skill without realizing it can access local secrets and persist data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The public description presents this as a regional customs statistics query tool, but the body also includes account creation, balance retrieval, recharge order generation, pricing queries, local credential storage, and external error reporting. That mismatch is dangerous because users and reviewers may consent to data lookup behavior while the skill also performs account-management and telemetry actions with financial and privacy implications.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements account provisioning, billing, and credential management for an analytics skill whose declared purpose is customs regional trade statistics. That capability mismatch is dangerous because users may invoke or install the skill expecting read-only analytics, while the code can create API keys, inspect account data, and initiate payment-related actions. In a skill ecosystem, unjustified privileged functions increase the attack surface and enable unexpected account and financial operations.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Recharge-order creation is unrelated to regional trade analytics and introduces a financial operation into a data-query skill. Even if the endpoint only returns a payment URL, exposing billing actions through an unexpected interface can facilitate social engineering, accidental charges, or abuse of the user's linked account context.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Automatic API key issuance and local persistence are not justified by the skill's analytics-focused manifest and create credential lifecycle risks. A user expecting simple statistical queries may not realize the skill can mint new credentials and store them on disk, which broadens persistence and secret-exposure risk beyond the advertised purpose.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script forwards request metadata and free-form context to a remote endpoint, which can expose sensitive operational details, identifiers, or user-derived content if those fields contain secrets or personal data. In this skill context, error reports from trade-analysis workflows may include company-related queries, request paths, and diagnostic text, creating a data-leakage risk when sent without explicit disclosure, minimization, or sanitization.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 89% confidence
• Finding: The skill instructs access to a local .env file containing an API key and supports generating and automatically storing new credentials there. Even if intended for setup, this is sensitive credential handling and becomes dangerous if the skill, logs, or surrounding agent expose file contents, mishandle permissions, or access more of the home directory than necessary.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 87% confidence
• Finding: This section explicitly instructs checking for UPKUAJING_API_KEY in ~/.upkuajing/.env and persisting a newly issued key to that file. The context makes the credential-access finding more serious because the same skill also performs billable network operations and account actions, increasing the risk of secret misuse, unauthorized API consumption, or exposure through automation.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 88% confidence
• Finding: This code accesses a local .env file to inspect whether an API key already exists, which is credential-handling behavior. In this skill context, credential discovery and management are more dangerous because they are outside the expected analytics-only scope, and reading/writing secrets in plain-text environment files increases the chance of exposure through local compromise, backups, or accidental disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 90% confidence
• Finding: The function opens and reads the .env file contents, then parses out the API key value. This is sensitive secret access, and the returned error path later includes part of the existing key in output, increasing disclosure risk if logs, terminals, or calling systems capture that message.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: The code writes the newly issued API key directly to a .env file, creating persistent plaintext credentials on disk. Plaintext secret persistence is a common source of compromise via filesystem access, backups, source-control accidents, support bundles, or overly broad permissions.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 86% confidence
• Finding: The error handling references manual setting of the API key environment variable and returns the env file path, reflecting continued reliance on insecure plaintext/environment-based secret handling. While the path itself is not always highly sensitive, the workflow normalizes unsafe secret management and can leak environment layout details useful to an attacker with partial access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.23.0), which allows installation of any newer release, including future versions with breaking changes or newly introduced supply-chain risk. While not an immediate exploit by itself, this weakens build reproducibility and can expose the skill to unexpected vulnerable or malicious package versions if the dependency ecosystem is compromised.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: Explicitly disabling authentication for the key-creation endpoint weakens the default security posture around credential provisioning. In the context of a trade-analytics skill, this is especially unjustified because users would not expect anonymous credential-minting behavior to be embedded in a data-query tool.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: Explicitly disabling authentication for the key-creation endpoint weakens the default security posture around credential provisioning. In the context of a trade-analytics skill, this is especially unjustified because users would not expect anonymous credential-minting behavior to be embedded in a data-query tool.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58