查询公司海关贸易HS编码维度统计数据 — 分析HS编码分布、贸易量分解和月度贸易趋势。支持全球 220 多个国家和地区的海关数据。帮助外贸团队深入分析 HS 编码层面的贸易构成、追踪产品类别的月度变化、识别核心进出口商品——是贸易品类分析和供应链优化决策的数据基础。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:43 AM UTC
• Version: 1.0.1

Overview

This is a paid HS-code trade-statistics API skill whose credential, billing, recharge, and reporting behaviors are mostly disclosed and tied to using the service.

Install only if you are comfortable giving the skill access to an Upkuajing API key, making paid API calls after confirmation, and storing that key in ~/.upkuajing/.env. Treat recharge links and error reports carefully, and avoid including secrets or sensitive business details in diagnostic context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require environment-variable access, local file reads/writes to ~/.upkuajing/.env, and outbound network/API operations. This under-declaration is dangerous because it prevents accurate review and informed consent about the skill's real capabilities, increasing the chance that a user or agent executes broader actions than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose is HS-code trade statistics, but the skill also instructs the agent to manage API keys, inspect account information, create recharge/payment orders, query pricing, report errors to the platform, and perform version-related remote activity. This behavior expansion broadens the trust boundary and can lead to sensitive actions, credential handling, and financial side effects that a user would not reasonably infer from the description alone.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements API key provisioning, account lookup, recharge ordering, and pricing queries, which materially exceed the declared HS-code statistics purpose of the skill. In a data-analysis skill context, unexpected authentication and billing capabilities expand the attack surface and create an opportunity for unauthorized account manipulation or monetization workflows that users would not reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The CLI exposes account-management and recharge actions that are unrelated to HS-code analytics, including creating recharge orders and retrieving platform pricing. In the context of an analytics skill, these hidden financial and account operations are dangerous because they enable side-effecting actions outside the user’s expected workflow and can be abused for unauthorized billing interactions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key to a local .env file, introducing local credential persistence in a skill whose stated purpose is statistical analysis. While not inherently malicious, secret issuance and storage are security-sensitive behaviors that become more concerning when they are embedded in an unrelated skill and may leave reusable credentials exposed on disk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound network access and writes to a user-local cache file even though the skill’s stated purpose is HS-code trade analytics. That mismatch creates an unnecessary side effect surface: metadata leaves the host and persistent state is modified outside the core business function, which can violate least-privilege expectations and surprise users in sensitive environments.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill contains self-update/version telemetry behavior unrelated to HS-code analysis and sends the skill name to a remote API. Even if the transmitted data is limited, hidden telemetry can enable inventorying of installed capabilities and creates an avoidable privacy and trust risk when embedded inside an analytics skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs agents to report failures by sending request parameters, response payloads, and error context to a platform API, but it does not require data minimization, user notice, or strict exclusion of sensitive business data before transmission. In this skill context, those fields can easily contain trade queries, company information, identifiers, and stack traces, creating a real privacy and data-leakage risk if agents forward raw contents during error handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When enabled, request logging writes transmitted parameters to disk without redaction. In this skill context, request parameters may contain company trade data, query terms, or other sensitive business inputs, so local log files can become an unintended disclosure point if the host is shared, backed up, or later collected.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When enabled, response logging persists full API responses and status data to disk. In a trade-statistics skill, responses can contain commercially sensitive analysis results, so logging them locally without warning or minimization increases confidentiality risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script forwards requestId, requestPath, and especially free-form context to a remote endpoint without any visible sanitization, redaction, or user-facing disclosure. If context contains user data, tokens, query contents, or internal error details, this can leak sensitive information to the platform and expand the privacy and data-handling attack surface.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code automatically posts the skill name to a remote endpoint without any user-facing notice or consent at the call site. In enterprise or regulated settings, undisclosed outbound requests can leak environment metadata and violate network-use or privacy policies, especially because this behavior is not necessary for the advertised analytics function.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill explicitly instructs reading a local secret file and handling an API key stored in ~/.upkuajing/.env. Accessing credential files is sensitive because it exposes secrets to the skill runtime and creates opportunities for unintended disclosure, reuse, or abuse of the user's paid account and associated data access.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the same credential-handling pattern by directing checks of ~/.upkuajing/.env and automatic saving of newly issued API keys to that file. Persisting credentials locally and encouraging agent-mediated secret setup increases the attack surface for credential theft, accidental exposure, and unauthorized future use.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 83% confidence
• Finding: The script reads the local .env file to locate an existing API key and processes its contents in plaintext. Plaintext credential handling increases the risk of accidental disclosure, and in this skill context it is especially suspicious because credential management is not necessary for HS-code analytics.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 94% confidence
• Finding: The script writes the API key directly to a .env file in plaintext, creating persistent reusable credentials on disk. If the file is read by other local processes, included in backups, or checked into source control, the key could be exposed and used to access the associated account or API resources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer version, including future releases that may introduce breaking changes or vulnerable transitive dependency combinations. This weakens build reproducibility and can unintentionally pull in a compromised or incompatible package version during deployment.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196