查询公司海关贸易HS编码列表数据 — 获取HS编码的贸易次数、金额和占比，用于供应商产品组合分析。支持全球 220多个国家和地区的海关数据。帮助外贸团队查看公司产品类别详情、分析贸易分类构成、深入钻取特定 HS 编码的贸易数据——是产品组合优化和采购商产品画像的关键工具。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:40 AM UTC
• Version: 1.0.1

Overview

This is a disclosed paid API skill for querying company HS-code trade data, with expected but sensitive account, billing, and API-key handling.

Install only if you trust upkuajing.com with your API usage, account metadata, and any error reports you explicitly submit. Keep ~/.upkuajing/.env private, avoid printing the API key in chats or logs, and expect paid API calls only after explicit confirmation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill exposes capabilities to read environment variables and local files, write local files, and make network requests, yet those capabilities are not cleanly declared as permissions. That creates a transparency and review gap: operators may approve a seemingly simple data-query skill without realizing it can access credentials, persist data locally, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior substantially exceeds the stated purpose of querying HS-code trade data: it also handles API key enrollment/storage, account inspection, recharge flows, pricing checks, error reporting, and local cache/version writes. This mismatch is dangerous because users and reviewers may consent to a narrow data lookup skill while unintentionally granting a broader operational and credential-handling surface.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation embeds account management, billing, pricing, and exception-reporting workflows inside a skill advertised as an HS-code list query tool. Even if legitimate, bundling these side capabilities increases the attack surface and normalizes sensitive operations like credential storage and outbound reporting in contexts where users may not expect them.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication lifecycle and billing-related functions (API key creation, account info, recharge order, pricing) that are materially broader than the declared HS-code lookup purpose. In an agent skill ecosystem, unexpected capability expansion increases attack surface and can enable unauthorized credential provisioning or financial actions under the guise of a data-query skill.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Creating recharge/payment orders is unrelated to HS-code trade analysis and introduces the ability to trigger financial workflows from a data-analysis skill. Even if the endpoint only returns a payment URL, this is a sensitive business action that could be abused for phishing, unwanted billing flows, or deception if exposed through an agent.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code can request a new API key from a remote service and persist it locally, which is a credential-provisioning capability not clearly justified by the HS-code query use case. In the skill context, silent credential creation and storage can lead to unauthorized account linkage, secret sprawl, and misuse of paid APIs.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Account-info and API-pricing retrieval exceed the narrowly described function of querying HS-code lists and reveal additional business/account metadata. In an agent environment, these extra capabilities can expose sensitive account details and normalize broader access than users expect from a trade-analysis skill.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The utility persists task metadata and result data under a local task_data directory, which goes beyond a simple transient query/listing helper. In this skill context, HS-code/company trade data may be commercially sensitive, and storing it by default increases exposure through local disk retention, later access by other processes/users, and accidental backup or sync.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This module introduces outbound network access and persistent local state for version checking, which is unrelated to the declared HS-code query functionality. While auto-update notification is a common feature, embedding it inside a skill expands the attack surface: it can leak skill usage metadata to a remote service, create undisclosed external dependencies, and enable abuse if the API base URL or update service is compromised.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger phrases are broad and loosely bounded, which increases the chance the skill activates in contexts beyond the user's intent. Because the skill can lead to paid API calls, credential handling, and related operational actions, ambiguous activation is more dangerous than it would be for a purely local read-only skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs agents to submit request parameters, response data, and error context to an external reporting API, which can include sensitive operational or user-derived data. Although it notes that sensitive fields are 'automatically masked,' it does not define the masking scope, require data minimization, or warn operators about privacy and confidential-data exposure, creating a real risk of over-sharing logs and payloads.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The request/response logging functions write full API parameters and responses to log files in the user's home directory when enabled, without redaction or user-facing notice. Because API payloads and returned trade data can contain sensitive business information, this creates a local data leakage risk and can unintentionally capture credentials or other confidential fields if they are ever included in requests or responses.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script forwards a caller-supplied 'context' field to a remote '/agent/skill/error/report' endpoint without any indication of redaction, minimization, or user disclosure. In an agent setting, error context often contains prompts, request payloads, identifiers, stack traces, or business data, so this can leak sensitive user or system information to the platform unnecessarily.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 93% confidence
• Finding: The skill instructs reading and populating `~/.upkuajing/.env` with an API key, which is credential access and local secret storage. This is sensitive because a skill framed as a data-query tool is also handling secrets, and any overbroad file access or logging mistake could expose the key and enable unauthorized paid API usage.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 92% confidence
• Finding: This section continues the credential-access pattern by directing the operator to inspect `~/.upkuajing/.env` and potentially add user-provided secrets there. The risk is amplified by the skill's broader network and billing functions: compromise of the stored API key could allow external account abuse, billing fraud, or unauthorized access to account-linked services.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 88% confidence
• Finding: The script reads an existing .env file to inspect whether an API key is present, participating in a pattern of local secret handling in plain text. In agent/plugin contexts, storing and reading secrets from predictable local files increases exposure to accidental disclosure, weak permissions, backup leakage, or access by other local processes.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 97% confidence
• Finding: The code writes a newly issued API key directly into a .env file in plaintext. Persisting credentials this way creates a real secret-management weakness because local files are commonly exposed through permissive permissions, logs, backups, sync tools, or later accidental disclosure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound, which allows future major or minor versions of httpx to be installed without review. This can introduce supply-chain risk through breaking changes or newly introduced vulnerable versions, and it also reduces build reproducibility across environments.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196