Query paginated HS code trade data for a company — retrieve HS codes with trade counts, amounts,and percentages for supplier product-mix analysis. Enables paginated HS code queries, companyproduct category details, trade classification breakdowns and HS code drill-down acrossglobal customs trade data covering 220+ countries.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.1

Overview

The skill performs its advertised paid HS-code lookup, but it also handles credentials, account/payment actions, diagnostics, and an automatic version check in ways users should review carefully.

Review before installing. Use this only if you are comfortable with a paid UpKuaJing integration that stores an API key on disk and can create recharge/payment URLs. Prefer setting UPKUAJING_API_KEY through a secure environment mechanism, avoid printing ~/.upkuajing/.env, and confirm any fee-incurring query or error report only after checking what data will be sent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37
• Finding: Credential File Contents May Be Exposed to the Agent and Command Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37-46 **Vulnerability Type**: Excessive exposure of a credential file **Risk Level**: Medium ### Vulnerable Code ```markdown This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file: ```bash cat ~/.upkuajing/.env ``` **Example file content**: ``` UPKUAJING_API_KEY=your_api_key_here ``` ### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; ``` ### Technical Analysis The documentation directs the Agent to execute `cat ~/.upkuajing/.env` to determine whether an API key is configured. This prints the complete file rather than checking only whether `UPKUAJING_API_KEY` exists. Although access to the API key is necessary for authenticated queries, exposing the whole credential file is not necessary. The file may contain the UpKuaJing key, comments, or additional credentials added by the user. Command output can enter the Agent context, terminal history, execution logs, transcripts, or diagnostic records. The Python implementation in `scripts/common.py` already supports reading only the named variable. Therefore, the full-file output instruction exceeds the minimum access and disclosure needed by the declared functionality. ### Attack Path 1. A user invokes the Skill without an API key in the process environment. 2. The Agent follows the setup instruction in `SKILL.md`. 3. The Agent executes `cat ~/.upkuajing/.env`. 4. Every value in the file is printed into an observable command result. 5. The output may be retained in Agent transcripts, terminal logs, monitoring systems, or debugging records. 6. Any party with access to those records may recover the API key or other secrets contained in the file. ### Impact Assessment The issue does not grant new filesystem privileges because the process can already read the user's file. However, it unnecessarily expands the exposure scope of secrets from a local credential file to command ...[truncated 280 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to execute `cat ~/.upkuajing/.env`. - Prefer the declared `UPKUAJING_API_KEY` environment variable as the sole credential source where practical. - If file fallback is retained, use the existing local parser to retrieve only `UPKUAJING_API_KEY` without printing its value. - Expose only a Boolean status such as “API key configured” or “API key missing.” - Never include the credential value, even partially, in Agent output, logs, exceptions, or diagnostic messages. - Advise users to keep unrelated credentials in separate files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:71
• Finding: Plaintext API Key File Is Created Without Enforced Owner-Only Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auth.py`, lines 71-74 **Vulnerability Type**: Insecure local secret storage permissions **Risk Level**: Medium ### Vulnerable Code ```python # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n") ``` ### Technical Analysis The newly issued API key is written in plaintext to `~/.upkuajing/.env` using the standard `open(..., 'w')` operation. The code does not explicitly enforce owner-only permissions on either the directory or the credential file. For a newly created file, effective permissions depend on the operating system and process umask. A permissive umask can result in a file readable by other local users. If the file already exists with weak permissions, opening it in write mode does not correct those permissions. The code also does not use an atomic, no-follow creation operation. While exploitation would generally require access to the user's home directory or an inadequately protected `~/.upkuajing` directory, security-sensitive files should defensively reject symbolic links and be created atomically. ### Attack Path 1. The user or Agent runs `python scripts/auth.py --new_key`. 2. The service returns a newly issued API key. 3. The script creates or truncates `~/.upkuajing/.env`. 4. File permissions are inherited from the environment's default mode and umask rather than being explicitly restricted. 5. On a shared system with permissive permissions, another local user reads the plaintext API key. 6. The other user uses the key to invoke authenticated UpKuaJing endpoints or consume the associated paid balance. An additional local attack may be possible if an attacker can pre-create or replace the destination with a symbolic link, although this requires pre-existing write access to the containing directory. ### Impact Assessment Successful exploitation exposes the privileges assigned to the API key. Those privileges include ...[truncated 331 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create `~/.upkuajing` with mode `0700` and verify that it is owned by the current user. - Create the credential file atomically with mode `0600`, for example using `os.open` with `O_CREAT`, `O_EXCL`, and, where available, `O_NOFOLLOW`. - For updates, write to a securely created temporary file in the same directory, set mode `0600`, flush and synchronize it, and atomically replace the destination. - Reject symbolic links and verify that the destination is a regular file owned by the current user. - Correct permissions on existing files before reading or updating them. - Prefer a platform credential store or keyring over a plaintext file when available. - Remove the partial key disclosure at `scripts/auth.py:34`; messages should state only that an existing key was found. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unbounded Dependency Version Permits Unaudited Future Releases<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt`, line 1; installation instruction at `SKILL.md`, lines 20-22 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code ```text httpx>=0.23.0 ``` The dependency is installed through the following documented setup flow: ```markdown 1. **Check Python**: `python --version` 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The lower-bound-only constraint allows any current or future `httpx` release satisfying `>=0.23.0`, together with whatever transitive dependency versions the resolver selects. Consequently, installations are not reproducible and may execute code that was not part of this audit. No evidence was found that `httpx` is malicious, typosquatted, or obtained from an untrusted package source. The risk comes from allowing unaudited future versions and unconstrained transitive dependencies. Package installation can execute build backends and other packaging code with the privileges of the user running `pip`. ### Attack Path 1. The user follows `SKILL.md` and runs `pip install -r requirements.txt`. 2. The package resolver selects the latest release satisfying `httpx>=0.23.0` and resolves its transitive dependencies. 3. A future compromised, malicious, or unexpectedly incompatible release satisfies the constraint. 4. Installation or import executes code from that release in the user's Python environment. 5. The compromised dependency gains the same local privileges as the process, potentially including access to the API-key environment variable and user-readable files. This path depends on a future supply-chain compromise or unsafe release; no such compromise was confirmed in the audited package. ### Impact Assessment If the dependency supply chain were compromised, malicious installation or runtime code would execute with the invoking user's privileges. It could access the API key, read or alter use ...[truncated 254 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `httpx` to a specific version that has been tested and audited. - Generate a lock file that includes exact versions of all transitive dependencies. - Record and enforce package hashes, such as through `pip install --require-hashes`. - Install dependencies in an isolated virtual environment rather than the user's global Python environment. - Use a trusted package index explicitly and review dependency updates before changing the lock file. - Add automated vulnerability scanning and scheduled dependency review to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill reportedly performs remote version checks, reads local metadata, writes a cache file under ~/.upkuajing, and emits upgrade notices—behavior unrelated to the stated HS-code query function. Hidden update or telemetry logic broadens the attack surface and introduces unexpected local persistence and outbound communication for a business-data lookup skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill reportedly performs remote version checks, reads local metadata, writes a cache file under ~/.upkuajing, and emits upgrade notices—behavior unrelated to the stated HS-code query function. Hidden update or telemetry logic broadens the attack surface and introduces unexpected local persistence and outbound communication for a business-data lookup skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill reportedly performs remote version checks, reads local metadata, writes a cache file under ~/.upkuajing, and emits upgrade notices—behavior unrelated to the stated HS-code query function. Hidden update or telemetry logic broadens the attack surface and introduces unexpected local persistence and outbound communication for a business-data lookup skill.

Credential Access

High

• Category: Privilege Escalation

Content

This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env
```
**Example file content**:
```

• Confidence: 99% confidence
• Finding: The instruction to run cat ~/.upkuajing/.env is a direct request to access a sensitive credential store. Because .env files commonly contain live API secrets, this behavior creates an obvious path for credential exposure, misuse of the user's paid account, and possible compromise of related services if the key is reused or insufficiently scoped.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: The skill instructs checking and manually modifying ~/.upkuajing/.env for API-key handling, and states that a newly created key will be automatically saved there. This encourages interaction with a local secret file and normalized persistence of credentials without clear safeguards, which increases the chance of accidental exposure or insecure storage practices.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 97% confidence
• Finding: Directing the agent to inspect whether ~/.upkuajing/.env contains UPKUAJING_API_KEY still constitutes access to a secret-bearing file, even if the goal is only presence checking. In practice, such instructions often result in reading or echoing the file content, which is especially risky in an LLM-mediated environment where outputs may be logged or surfaced unintentionally.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill is described as an HS-code trade-data query tool, but the file adds separate authentication lifecycle and billing capabilities such as API key provisioning, account lookup, recharge creation, and pricing retrieval. That scope expansion is dangerous because it gives the skill access to credential and payment-adjacent operations unrelated to the stated user task, increasing the attack surface and enabling abuse if invoked unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can request a new platform API key and persist it locally, which is an unjustified sensitive capability for a company HS-code listing skill. Provisioning credentials inside a data-retrieval skill creates a path for unauthorized credential creation, persistence, and later misuse, especially because the skill context does not require users to manage platform identity or secrets.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: This line writes the API key into a local .env file in plaintext, creating durable credential exposure on disk. In the context of a skill that should only query HS-code data, credential persistence is especially risky because it enables later unauthorized use of platform access outside the user’s immediate action.

Credential Access

High

• Category: Privilege Escalation

Content

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file adds outbound exception reporting to a platform endpoint, which is outside the skill's declared purpose of HS code list retrieval. That hidden or undocumented behavior increases supply-chain risk because runtime context may be exfiltrated during failures, and users or integrators would not reasonably expect network transmission of diagnostic data from this skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises executable behavior that can access environment variables, read and write local files, and make network requests, but it declares no explicit tool scope or permission boundary. That makes the skill harder to sandbox and review, and increases the risk that a caller or agent may invoke capabilities beyond what users expect from a simple HS-code query tool.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs reading a local .env file containing the API key via a shell command, without any warning against exposing the secret in chat output or logs. In an agent setting, this can lead to direct credential disclosure to the model, the user, or telemetry systems, turning a normal setup step into a secret-exfiltration risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API documentation explicitly encourages sending raw request parameters, response payloads, and exception context to a centralized error-reporting endpoint. Although it notes that sensitive fields will be automatically redacted, it does not define the redaction scope or require callers to minimize data before submission, creating a realistic risk of over-collection and leakage of confidential business data, personal data, tokens, or stack traces.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False for /agent/auth/create establishes an unsafe default in this skill because a user invoking a data-query tool can reach credential-provisioning behavior without prior authentication. Given the mismatch between declared skill purpose and implemented capability, this increases risk and is more dangerous than it would be in a dedicated account-registration component.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False for /agent/auth/create establishes an unsafe default in this skill because a user invoking a data-query tool can reach credential-provisioning behavior without prior authentication. Given the mismatch between declared skill purpose and implemented capability, this increases risk and is more dangerous than it would be in a dedicated account-registration component.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code writes a newly issued API key directly to a local .env file on disk without a prior warning, opt-in, permission hardening, or use of a secure secret store. Storing credentials in plaintext files increases exposure to local compromise, accidental inclusion in backups or source control, and unauthorized reuse by other processes or users on the host.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script exposes account balance, recharge-order creation, and pricing-management discovery that are unrelated to retrieving HS-code trade data. These functions reveal financial/account metadata and can trigger payment workflow actions, broadening the skill beyond its declared purpose and creating unnecessary risk if the capability is abused or called unintentionally.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s human-facing natural language is exclusively Chinese, starting with the module description, and the code later emits only Chinese user-facing messages. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58