Query paginated HS code trade data for a company — retrieve HS codes with trade counts, amounts,and percentages for supplier product-mix analysis. Enables paginated HS code queries, companyproduct category details, trade classification breakdowns and HS code drill-down acrossglobal customs trade data covering 220+ countries.

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:04 AM UTC
• Version: 1.0.0

Overview

This is a paid UpKuaJing API helper that is broadly coherent with its stated HS-code lookup purpose, but users should understand its API key, billing, and local file behavior before use.

Install only if you are comfortable with a paid third-party API client storing an UpKuaJing API key in ~/.upkuajing/.env and making network calls to UpKuaJing. Confirm costs before running queries or top-up flows, and avoid enabling API logging if query parameters or responses are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its documented behavior clearly involves environment-variable access, reading and writing files under the user's home directory, and making network requests. This under-declaration reduces transparency and can cause users or platforms to authorize a skill without understanding that it can access credentials and persist data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to perform a paginated HS-code lookup, but the instructions also cover account creation, balance inspection, pricing queries, payment-order generation, credential storage, and remote version checks. This scope expansion is security-relevant because it enables sensitive account, billing, and persistence operations beyond the narrowly described data-query purpose, increasing the chance of unexpected charges or credential handling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account management, API key provisioning, pricing lookup, and recharge order creation, which exceeds the declared purpose of an HS-code analytics skill. Such scope expansion increases attack surface and can trigger unintended financial or credential-management actions from a skill that users would reasonably expect to only query trade classification data.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill can create recharge/payment orders via an auth/pay endpoint even though its stated purpose is supplier product-mix analysis. Financial-action capability in an analytics skill is dangerous because it can be abused to initiate unauthorized billing workflows or socially engineer users into completing payments they did not intend.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code provisions a new API key and persists it locally in a user environment file, which is unrelated to the declared analytics-only function. Credential issuance and storage broaden the blast radius of compromise and can expose reusable secrets if the host is shared, backed up insecurely, or if file permissions are weak.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module introduces network access and persistent local writes that are unrelated to the declared HS-code lookup function, expanding the skill's behavior and attack surface without clear necessity. Even if intended for update checks, hidden side effects such as outbound telemetry and filesystem modification can violate least-privilege expectations and create privacy, policy, or supply-chain risk if the endpoint or base URL is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill contains self-update/version telemetry behavior that is not justified by its stated customs HS-code query purpose. Such hidden maintenance channels are risky because they enable unanticipated outbound communication and can normalize future remote-control or supply-chain patterns, especially when driven by external configuration like an API base URL.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The request/response logging helpers can write full API parameters and full response bodies to local log files, which may include sensitive business data or identifiers. Although logging is disabled by default, enabling it creates a silent local data-retention channel without redaction, minimization, or explicit user consent at the write points.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The code sends the skill name to a remote API without any user-facing disclosure in this file, creating a small but real transparency and privacy issue. While the payload is limited, undisclosed outbound metadata transmission is still a security concern because it can reveal installed capabilities or usage context to a remote service.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 92% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 92% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: httpx>=0.23.0

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 89% confidence
• Finding: auth=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 89% confidence
• Finding: require_auth=False

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58