ClawHub
Back to skill

Security audit

查询公司海关贸易HS编码维度统计数据 — 分析HS编码分布、贸易量分解和月度贸易趋势。支持全球 220 多个国家和地区的海关数据。帮助外贸团队深入分析 HS 编码层面的贸易构成、追踪产品类别的月度变化、识别核心进出口商品——是贸易品类分析和供应链优化决策的数据基础。

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised trade-statistics queries, but it also handles API keys, billing/account actions, telemetry, and an undisclosed version check in ways users should review carefully.

Install only if you are comfortable with this skill managing an Upkuajing API key, making paid API calls after confirmation, creating recharge-payment URLs, and sending confirmed error reports. Do not run the documented cat command on the .env file in an agent transcript, and consider storing the key with stricter local permissions or a secret manager.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

API Key Disclosure Through Documented Terminal Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-43
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Code

markdown
The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file contents:

text
UPKUAJING_API_KEY=your_api_key_here
text

### Technical Analysis

The documented setup procedure instructs the Agent or user to print the entire credential file to standard output. This operation is unnecessary for checking whether the required key exists.

Standard output may be retained in Agent conversation context, command-execution logs, terminal scrollback, CI logs, screen recordings, telemetry, or debugging records. Consequently, the instruction can move the complete API key from a protected file into less-protected output channels.

Internal access to the specific `UPKUAJING_API_KEY` value is necessary for authenticated API requests, but exposing the value in terminal output exceeds the minimum privilege and disclosure requirements of the Skill.

### Attack Path

1. A user or Agent follows the credential setup instructions.
2. The documented `cat ~/.upkuajing/.env` command is executed.
3. The complete API key is printed to standard output.
4. The output is captured in Agent context, execution logs, terminal history, telemetry, or a recording.
5. A party with access to that output extracts the key.
6. The exposed key is reused against the Upkuajing API for authenticated and potentially billable operations.

### Impact Assessment

Exploitation does not grant operating-system privilege escalation, but it may grant the attacker the API privileges assigned to the compromised key. This can include unauthorized billable queries, access to account-related API information, diagnostic submissions, and creation of payment-order URLs.

The scope is limited to the affected Upkuajing API account and the permissions a
...[truncated 33 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to run cat ~/.upkuajing/.env.
  • Check only whether the required variable exists and is non-empty without displaying its value.
  • Provide a dedicated status command that returns a boolean or a masked value such as UPKUAJING_API_KEY=********.
  • Prevent credentials from being included in Agent-visible output, debug logs, error messages, or command transcripts.
  • If a key has already appeared in captured output, rotate it and remove the exposed value from retained logs where feasible.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:71
Finding

Credential File Is Created Without Explicitly Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 71-74
Vulnerability Type: Insecure plaintext credential storage permissions
Risk Level: Medium

Vulnerable Code

python
# Save to .env file
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

A newly issued API key is written as plaintext using the default permissions derived from the process umask. The code does not explicitly create the credential file with mode 0600, verify its final permissions, or ensure that the parent directory is restricted to mode 0700.

On a system configured with an unusually permissive umask or inherited directory permissions, another local user may be able to read the credential. The write also truncates the target file directly rather than using a securely created temporary file followed by an atomic replacement.

Persisting the API key is related to the declared authentication function, but leaving its access controls to ambient process configuration does not adequately enforce least disclosure.

Attack Path

  1. A user runs auth.py --new_key.
  2. The script obtains a new API key from the unauthenticated key-creation endpoint.
  3. The script creates or overwrites ~/.upkuajing/.env using permissions inherited from the current umask.
  4. If those permissions allow access by another local account, that account reads the plaintext file.
  5. The local attacker extracts UPKUAJING_API_KEY.
  6. The attacker uses the key for authenticated requests to the platform.

Exploitation requires local access and a permissive resulting file or directory permission configuration.

Impact Assessment

A successful attacker gains the API privileges associated with the stolen key rather than additional operating-system privileges. Potential consequences include unauthorized charged queries, account information exposure, diagnostic su ...[truncated 208 chars]

Remediation
View remediation

Remediation Suggestions

  • Ensure ~/.upkuajing is owned by the current user and has mode 0700.
  • Create the credential file atomically with mode 0600, such as by using os.open with O_CREAT, O_EXCL, and an explicit permission mode.
  • Apply os.chmod(env_file, 0o600) after writing and verify the resulting permissions.
  • Write through a securely created temporary file in the same directory and atomically replace the destination.
  • Reject symlink targets before writing to reduce file-redirection risks.
  • Consider using the operating system credential store instead of a plaintext environment file.
  • Avoid truncating unrelated variables if an existing .env file must be updated.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Version

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Non-reproducible and insufficiently constrained dependency installation
Risk Level: Low

Vulnerable Code

text
httpx>=0.23.0

The documented installation procedure executes:

bash
pip install -r requirements.txt

Technical Analysis

The dependency specification sets only a minimum version and permits any future release of httpx. Installation is therefore not reproducible and may select versions that were never reviewed or tested with the Skill.

No lock file or package hashes are supplied. If a future allowed release is compromised, contains a security regression, or introduces an incompatible behavior, the documented installation process can incorporate that release automatically.

This is not evidence that the current httpx package is malicious. The confirmed issue is that dependency integrity and version selection are insufficiently constrained.

Attack Path

  1. A user follows the documented dependency installation procedure.
  2. Package resolution selects the newest release satisfying the open-ended constraint.
  3. A future compromised or vulnerable release is accepted because there is no upper bound, exact pin, or integrity hash.
  4. The package is installed into the Skill’s Python environment.
  5. Its installation or runtime code executes when the Skill imports and uses httpx.

This path depends on a compromised, malicious, or vulnerable future package release or package-delivery channel.

Impact Assessment

The potential impact is bounded by the privileges of the user or Agent process performing the installation and running the Skill. A compromised dependency could access the API key, inspect query parameters and responses, modify network traffic, or execute arbitrary Python behavior under that account.

There is no evidence in the audited project that such compromise is cur ...[truncated 17 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to a specific reviewed version.
  • Generate a lock file containing exact transitive dependency versions.
  • Require cryptographic hashes during installation, for example through a hash-locked requirements file.
  • Test and review dependency upgrades before changing the lock file.
  • Use automated vulnerability monitoring while retaining manual approval for dependency updates.
  • Install dependencies from the official package index over authenticated TLS and avoid untrusted additional indexes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description focuses on customs HS statistics, yet the implementation reportedly includes remote version checks, local metadata parsing, cache reads/writes under ~/.upkuajing, and upgrade notifications. These unrelated update-management behaviors broaden local file and network access and create hidden side effects that are not necessary for the core analytics task.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description focuses on customs HS statistics, yet the implementation reportedly includes remote version checks, local metadata parsing, cache reads/writes under ~/.upkuajing, and upgrade notifications. These unrelated update-management behaviors broaden local file and network access and create hidden side effects that are not necessary for the core analytics task.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description focuses on customs HS statistics, yet the implementation reportedly includes remote version checks, local metadata parsing, cache reads/writes under ~/.upkuajing, and upgrade notifications. These unrelated update-management behaviors broaden local file and network access and create hidden side effects that are not necessary for the core analytics task.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill explicitly instructs reading the API key file with cat ~/.upkuajing/.env, which exposes the full secret rather than merely checking whether a key exists. In an agent context, this creates a direct credential-access path and may cause secrets to be surfaced in logs, model context, or user-visible output.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The workflow tells the agent to inspect ~/.upkuajing/.env for the API key and to support automatic creation and saving of new keys into that file. This normalizes direct credential-file handling inside a skill whose stated purpose is analytics, increasing the risk of secret leakage, tampering, or persistence of credentials in insecure local storage.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This section continues the direct handling of ~/.upkuajing/.env, including user-supplied manual edits and automatic secret persistence. In context, this is especially risky because the skill also has network and file capabilities, so compromise or misuse could expose or overwrite credentials while appearing to perform routine trade-analysis tasks.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file implements authentication, API key issuance, account lookup, recharge, and pricing functions that are outside the declared purpose of HS-code statistical analysis. Such scope expansion is dangerous because it introduces credential handling and billing capabilities into a skill that users would not expect to manage secrets or financial operations, increasing the risk of unauthorized account actions and deceptive behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The function is explicitly designed to work with a .env file containing API credentials. Handling credentials in local plaintext files is risky because such files may be read by other local processes, accidentally committed, backed up insecurely, or exposed through misconfigured permissions.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The code reads the entire .env file to locate an existing API key, confirming that this skill directly accesses credential material. Direct credential-file parsing inside a non-authentication-focused skill broadens exposure of secrets and increases the chance of leakage through logs, errors, or future code changes.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The script writes the newly issued API key directly into a .env file in plaintext. Persisting secrets this way creates a durable credential exposure point that can be stolen from disk, accidentally synced, or harvested by malware or other users on the system.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The error path instructs the user to manually set the environment variable for the API key, reinforcing insecure secret handling patterns. While not an exploit by itself, it encourages ad hoc credential management that may lead to leakage through shell history, process listings, or unsafe configuration practices.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script can create recharge/payment orders even though the skill is described as HS-code trade analytics. Billing functionality in an unrelated analytics skill can be abused to trigger unintended financial workflows or mislead users into authorizing payments they did not expect from this capability.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a skill for querying and analyzing company customs HS-code trade statistics, but this file implements exception reporting to a platform endpoint. Reporting runtime errors is not part of the user-facing HS-code analytics behavior described in the manifest, so the code's actual operation materially exceeds the declared semantic scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requests and documents capabilities to read environment variables, access local files, write local files, and perform network operations, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent runtime may grant broader access than users expect, enabling unintended credential exposure or file/network actions during normal use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and command descriptions are presented entirely in Chinese, and the file does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code requests a new platform API key and persists it locally, which is not justified by the stated analytics-only purpose. Unnecessary key issuance and storage increases the attack surface for credential leakage, unauthorized API consumption, and hidden account enrollment or linkage.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The call to report errors to '/agent/skill/error/report' adds a telemetry capability unrelated to analyzing HS-code distributions, trade volumes, or monthly trends. While operationally useful, this networked reporting function is not directly justified by the manifest's stated business purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code forwards a caller-supplied 'context' field, along with request metadata, to a remote platform endpoint without any minimization, redaction, or disclosure visible in this file. If 'context' contains user inputs, system details, stack traces, tokens, or business data, the skill could exfiltrate sensitive information through routine error reporting, which is especially concerning because this skill's declared purpose is trade analytics rather than telemetry collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code file contains natural-language descriptions and notifications entirely in Chinese, including the module docstring and upgrade notice text. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a locale-policy violation.

Content

No source excerpt is available for this finding.