ClawHub
Back to skill

Security audit

查询公司海关贸易HS编码列表数据 — 获取HS编码的贸易次数、金额和占比，用于供应商产品组合分析。支持全球 220多个国家和地区的海关数据。帮助外贸团队查看公司产品类别详情、分析贸易分类构成、深入钻取特定 HS 编码的贸易数据——是产品组合优化和采购商产品画像的关键工具。

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to support its stated paid HS-code lookup purpose, but it also handles API keys, billing, telemetry, and automatic version checks in ways users should review before installing.

Install only if you are comfortable giving the skill access to a paid Upkuajing API key and account workflows. Do not print or paste the contents of ~/.upkuajing/.env into an agent transcript; prefer an environment variable or protected secret store, review payment/order actions before confirming them, and avoid including sensitive business data in error reports.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

Credential Disclosure Through Documented Shell Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-43
Vulnerability Type: Exposure of plaintext credentials in terminal and agent output
Risk Level: Medium

Vulnerable Code

markdown
This Skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text
UPKUAJING_API_KEY=your_api_key_here
text

The original documentation at this location instructs the operator to execute `cat ~/.upkuajing/.env`.

### Technical Analysis

The documented `cat` command prints the entire credential file to standard output. Checking whether an API key is configured does not require displaying its value. When an AI agent follows this instruction, the plaintext key may enter the agent transcript, terminal history or recording, CI logs, support diagnostics, or other retained output.

The application legitimately needs access to `UPKUAJING_API_KEY` to authenticate to the declared API. However, displaying the secret exceeds the minimum access necessary for that functionality. This is a credential-handling weakness rather than evidence that the code intentionally sends the key to an unrelated destination.

### Attack Path

1. A user or agent follows the environment setup instructions.
2. The documented `cat ~/.upkuajing/.env` command is executed.
3. The complete API key appears in terminal or agent-visible output.
4. The output is retained in a transcript, log, recording, or copied diagnostic report.
5. A party with access to that retained output extracts the API key.
6. The exposed key is used to make authenticated and potentially billable requests to the Upkuajing API.

### Impact Assessment

Exploitation can disclose the privileges associated with the API token. An attacker possessing the token may be able to perform authenticated queries, consume the account balance, access account-related API data, or invoke other endpoint
...[truncated 190 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to run cat ~/.upkuajing/.env.
  • Check only whether the variable exists and is nonempty, without printing its value.
  • Provide a dedicated status command that returns only a boolean or a redacted fingerprint.
  • Never instruct users to paste an API key into an agent conversation.
  • Redact secrets from terminal output, diagnostics, logs, and error messages.
  • Prefer injecting the credential through the declared UPKUAJING_API_KEY environment variable or a platform-managed secret store.
  • Add documentation warning that the .env file and its contents must not be included in transcripts or support reports.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:63
Finding

API Key File Is Created Without Enforced Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 63-74
Vulnerability Type: Insecure storage permissions for a plaintext API credential
Risk Level: Medium

Vulnerable Code

python
# Ensure the ~/.upkuajing directory exists
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

# Save to the .env file
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

The source code at this location creates the directory with mkdir(parents=True, exist_ok=True) and writes the credential using ordinary open(..., 'w'), without applying explicit directory or file modes.

Technical Analysis

The API key is intentionally stored in plaintext at ~/.upkuajing/.env, but the code does not enforce owner-only permissions on either the parent directory or the credential file. Effective permissions therefore depend on the process umask and any pre-existing filesystem object. Under a permissive or commonly configured umask, the file may be readable by other local users. If the file already exists, opening it with mode w truncates it but generally retains its existing permissions.

The implementation also does not verify whether the destination is a symbolic link before writing. In an environment where another local principal can manipulate the destination path, that omission could cause the credential to be written through an unexpected link. The practical feasibility depends on permissions surrounding the user's home directory.

Reading a dedicated credential file is consistent with authenticated API functionality. The security issue is that the storage operation does not enforce the minimum filesystem protections expected for a secret.

Attac

...[truncated 1111 chars]

Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with owner-only mode 0700.
  • Create the credential file with mode 0600, using low-level flags such as O_CREAT, O_WRONLY, and an explicit mode.
  • Apply chmod(0o600) to an existing credential file before or immediately after updating it.
  • Refuse to write through symbolic links where supported, for example by using O_NOFOLLOW and verifying the resulting file with fstat.
  • Write to a securely created temporary file in the same directory, set its mode to 0600, flush it, and atomically replace the destination.
  • Verify that the destination is a regular file owned by the current user.
  • Prefer an operating-system credential store or platform-managed secret service over a plaintext .env file when available.
  • Add a migration check that warns about and corrects unsafe permissions on existing installations.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned dependency without integrity verification
Risk Level: Low

Vulnerable Code

text
httpx>=0.23.0

SKILL.md also instructs users to install this dependency with:

bash
pip install -r requirements.txt

Technical Analysis

The lower-bound-only constraint allows any future httpx release satisfying the constraint to be installed. No upper bound, exact version, lock file, or package hash is supplied. Consequently, installations are not reproducible and may receive a release that was not reviewed with this Skill.

Package installation can execute package build and installation behavior in the context of the invoking user. This finding does not establish that httpx is malicious; the risk arises from trusting an unrestricted future version and not verifying artifact integrity.

Attack Path

  1. A user follows the documented installation command.
  2. The package resolver selects the newest available version satisfying the open-ended constraint.
  3. A future compromised, malicious, or incompatible release is selected without project review.
  4. Package installation or subsequent import executes behavior from that release with the user's privileges.
  5. Depending on the compromised package behavior, local data, credentials, API traffic, or Skill execution may be affected.

This path requires a compromised upstream release, package-index compromise, or an unexpectedly incompatible future version; no such compromise was identified during this audit.

Impact Assessment

A compromised dependency installed into the user's Python environment could execute with the same operating-system privileges as the installer or Skill process. That may permit reading user-accessible files, including the API credential, modifying the Python environment, or making network requests. The practical likelihood is lo ...[truncated 104 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to a specifically reviewed version.
  • Generate and commit a lock file containing all transitive dependency versions.
  • Record cryptographic hashes and install with pip's --require-hashes option.
  • Review dependency updates before changing the lock file.
  • Install dependencies inside an isolated virtual environment rather than the user's global Python environment.
  • Use a trusted package index over TLS and consider an internally controlled dependency mirror.
  • Add automated vulnerability and provenance scanning for direct and transitive dependencies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (38)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates the skill also performs version-management behavior such as reading local metadata, calling remote version-check endpoints, and creating a cache file under ~/.upkuajing/version_cache.json, none of which is part of the declared HS-code analytics purpose. Hidden update logic adds unexpected file and network side effects and increases the attack surface for tracking, tampering, or abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates the skill also performs version-management behavior such as reading local metadata, calling remote version-check endpoints, and creating a cache file under ~/.upkuajing/version_cache.json, none of which is part of the declared HS-code analytics purpose. Hidden update logic adds unexpected file and network side effects and increases the attack surface for tracking, tampering, or abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates the skill also performs version-management behavior such as reading local metadata, calling remote version-check endpoints, and creating a cache file under ~/.upkuajing/version_cache.json, none of which is part of the declared HS-code analytics purpose. Hidden update logic adds unexpected file and network side effects and increases the attack surface for tracking, tampering, or abuse.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill instructs reading the full ~/.upkuajing/.env file via cat, which risks exposing the API key and potentially other secrets present in that file. In an agent context, encouraging raw secret-file access is dangerous because secrets may be surfaced to logs, the model, or the user interface unnecessarily.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill directs the agent to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY and potentially trigger auth.py --new_key to create and save a new key automatically. This combines credential discovery and credential creation/storage inside a data-query skill, increasing the risk of unauthorized secret handling and persistent storage of sensitive credentials on disk.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The instructions normalize manual addition of user-provided secrets to ~/.upkuajing/.env and automatic persistence of newly created API keys to the same file. That practice encourages long-lived plaintext credential storage and broad file access patterns that are unnecessary for a simple HS-code lookup workflow.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file implements authentication, account lookup, API key issuance, recharge order creation, and pricing queries, which materially exceed the declared HS-code list analysis purpose of the skill. Capability mismatch is dangerous because users may install or trust the skill for benign trade analysis while it silently introduces account-management and billing actions that expand attack surface and enable unauthorized financial or credential operations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The code stores a newly issued API key in a plain-text .env file under the user's home directory without any visible permission hardening, encryption, or secure-storage control. Plain-text credential persistence increases the risk of local compromise by other users, backup leakage, accidental inclusion in archives, or malware harvesting of API keys.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

On write failure, the script instructs the user to manually set the API key via an environment variable, which can lead to insecure handling such as shell history exposure, process-environment leakage, or accidental disclosure in logs and screenshots. While not an exploit by itself, it promotes weaker credential-handling practices in a skill already performing credential issuance.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requests and documents capabilities to read environment secrets, read/write local files, and make network calls, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an unnecessary trust gap: a user may think the skill only queries HS-code data, while the implementation can also access credentials, modify local state, and contact unrelated endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document explicitly instructs callers to send request parameters, response data, and error context to an error-reporting API, and only notes that sensitive fields will be automatically masked. That does not guarantee complete redaction, and there is no explicit user-facing warning, consent flow, or data-minimization guidance before transmitting potentially sensitive operational or business data off-path for telemetry.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module docstring and CLI descriptions present the skill exclusively in Chinese, which imposes a specific language on users without offering a choice. Under the stated policy, forcing a locale or language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Recharge-order creation and platform pricing queries are unrelated to the core business function of querying company customs HS-code lists. Even if legitimate in the broader product ecosystem, embedding billing workflows in this skill increases the chance of misuse, deceptive scope expansion, or unintended charges from a context where users would not expect payment operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains natural-language module documentation in Chinese, and the rest of the user-facing messages in the file are also Chinese-only. Under the language/locale policy, forcing a specific language without user opt-in or explicit justification is a policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes a company customs HS-code list query capability for retrieving trade counts, amounts, and proportions. In addition to making API queries, this module creates task directories, stores metadata/results on disk, and provides generic file-writing helpers, which expands behavior into local job persistence rather than just query execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The request logger can persist full request parameters to a local log file under the user's home directory. If enabled, sensitive business inputs or identifiers sent to the API may be stored without redaction, increasing exposure to local compromise, accidental disclosure, or over-retention of query data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The response logger can persist entire server responses and status metadata to local files. API responses may contain sensitive commercial data, account details, or other information that should not be retained unredacted, so enabling this feature can create a secondary data-at-rest exposure.

Content

No source excerpt is available for this finding.