查询公司海关贸易HS编码列表数据 — 获取HS编码的贸易次数、金额和占比，用于供应商产品组合分析。支持全球 220多个国家和地区的海关数据。帮助外贸团队查看公司产品类别详情、分析贸易分类构成、深入钻取特定 HS 编码的贸易数据——是产品组合优化和采购商产品画像的关键工具。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:09 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent paid API client, but it should be reviewed because it handles billing/account actions and stores API keys in a plaintext local file.

Install only if you are comfortable with a paid Upkuajing API workflow. Use a dedicated API key, avoid sharing or printing ~/.upkuajing/.env, confirm any paid query or recharge action explicitly, and review the plaintext credential, logging, and version-check behavior before use in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading environment variables, accessing local files under ~/.upkuajing, writing credentials, and calling remote APIs. This mismatch is dangerous because it hides the true privilege and trust boundary from reviewers and users, increasing the chance of unintended credential exposure or paid network actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill claims to provide HS-code trade queries, but it also documents account creation, local credential storage, account-info retrieval, recharge order creation, pricing queries, and version/cache behavior. This scope expansion is dangerous because a user invoking a data lookup skill may unknowingly trigger credential handling, billing-related operations, or persistent local state changes beyond the advertised purpose.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The file implements authentication, API-key issuance, account balance lookup, and recharge-order creation, which materially exceed the declared HS-code query/analytics purpose. This mismatch increases supply-chain risk because users invoking a data-query skill may unknowingly trigger credential provisioning or billing-related actions they did not expect.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Creating recharge orders is unrelated to HS-code listing and introduces a financial side effect into a supposedly analytics-focused skill. In skill ecosystems, unexpected payment capabilities are dangerous because they expand abuse potential and can mislead users into authorizing or triggering billing flows unintentionally.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatic API key application and local persistence are not justified by the stated read-oriented HS-code listing purpose and unnecessarily broaden the credential-handling surface. This creates risk of silent credential issuance, storage, and later misuse if the host environment or local files are exposed.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module performs outbound version-checking and upgrade-notification behavior that is unrelated to the declared HS-code query purpose of the skill. While not overtly malicious, hidden or undeclared network behavior expands the skill's attack surface, creates a covert telemetry path, and can normalize remote control/update patterns in a data-query skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill contains self-update checking capability that is not justified by its stated business function. Even though it only sends the skill name, this creates unnecessary external dependency and a non-business-related network channel that could be abused for tracking, policy bypass, or future expansion into more dangerous remote update behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes a newly issued API key directly to a local .env file without an explicit confirmation step or secure-storage alternative. Secrets persisted this way may be exposed through weak file permissions, backups, accidental sharing, or other tools that load or inspect environment files.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The request/response logging helpers write full transmitted parameters and API responses to local log files when enabled, potentially capturing company trade data or other sensitive business information without redaction. Because logging is implemented centrally and silently, an operator may enable it without realizing that sensitive payloads will persist on disk.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The code transmits the skill name to a remote API without disclosure at the point of transmission or an obvious consent mechanism. Although the data appears low sensitivity, silent outbound metadata transmission can still leak installed capabilities, enable usage profiling, and violate user expectations in restricted environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 84% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 84% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 89% confidence
• Finding: httpx>=0.23.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196