ClawHub
Back to skill

Security audit

查询公司海关贸易HS编码维度统计数据 — 分析HS编码分布、贸易量分解和月度贸易趋势。支持全球 220 多个国家和地区的海关数据。帮助外贸团队深入分析 HS 编码层面的贸易构成、追踪产品类别的月度变化、识别核心进出口商品——是贸易品类分析和供应链优化决策的数据基础。

Security checks across malware telemetry and agentic risk

Overview

This skill is a paid HS-code analytics API wrapper with disclosed credential and billing flows, though users should understand it stores an API key locally and makes paid network calls.

Install only if you are comfortable using Upkuajing's paid API. Expect the skill to read or create ~/.upkuajing/.env, store UPKUAJING_API_KEY there in plaintext, make network calls to Upkuajing, and require explicit confirmation before charged queries. Do not paste or display the full API key in chat, and review charges or recharge links before proceeding.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documentation indicates capabilities to read environment variables, access local files such as ~/.upkuajing/.env, write credentials locally, and make network calls, but these permissions are not explicitly declared to the user. This weakens transparency and consent boundaries, making it easier for a skill to access secrets or modify local state under the guise of a simple data-query function.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The declared purpose is a read-oriented HS-code statistics query skill, but the documented behavior extends to account management, API key issuance/storage, billing/recharge order creation, pricing queries, and remote version checks with local caching. This mismatch is dangerous because users may authorize a seemingly narrow analytics skill without realizing it can manipulate credentials, trigger financial workflows, or persist data locally.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file implements credential issuance, account lookup, and recharge/payment-related actions even though the skill is presented as an HS-code statistics tool. This capability mismatch is dangerous because it expands the trust boundary: a user invoking a data-analysis skill may unknowingly trigger account-management flows and local credential persistence unrelated to the advertised purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The script contains full account-management and recharge-order functionality that cannot be justified by the declared analytics use case. In a misaligned skill context, such hidden capabilities increase the risk of unauthorized account operations, unexpected billing interactions, and credential handling under false user expectations.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The module performs outbound network access to a remote version endpoint and writes persistent state under the user's home directory, behavior unrelated to the stated HS trade analytics purpose. In a skill context, this creates undeclared telemetry and filesystem side effects, expanding the trust boundary and enabling metadata leakage or policy bypass if the endpoint or base URL is misused.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill contains self-update/version telemetry logic that contacts a server with the skill name and compares installed versus latest versions, despite this not being necessary for customs HS-code analysis. This hidden control-plane behavior is risky because it introduces covert communications and can be repurposed for tracking, environment probing, or future unauthorized update workflows.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code writes a newly issued API key directly to a local .env file without a prior interactive warning or confirmation at the point of persistence. This is risky because sensitive credentials may be stored on disk in locations users do not expect, where they can later be exposed via backups, misconfigured permissions, or local file disclosure.

Credential Access

High
Category
Privilege Escalation
Content
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
95% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
95% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
91% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
89% confidence
Finding
httpx>=0.23.0

Unsafe Defaults

Medium
Category
Tool Misuse
Content
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:
Confidence
84% confidence
Finding
auth=False

Unsafe Defaults

Medium
Category
Tool Misuse
Content
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:
Confidence
84% confidence
Finding
require_auth=False

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196