Query company customs trade statistics by HS code dimension — analyze HS code distribution,trade volume breakdown, and monthly trade trends. Provides trade HS code analysis, companyproduct category breakdown, import-export classification analysis and global trade codeintelligence for comprehensive trade pattern understanding.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:43 AM UTC
• Version: 1.0.1

Overview

The skill appears to provide the advertised customs HS-code statistics, but it needs Review because it combines paid-account credential handling with under-disclosed automatic version-check traffic and local persistence.

Install only if you are comfortable with a paid UpKuaJing API workflow that stores the API key in ~/.upkuajing/.env. Confirm fees before running queries or top-up flows, avoid sending sensitive details in error reports, and be aware that the skill automatically checks for newer versions and writes a local cache even though that behavior is not clearly disclosed in the skill instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes capabilities beyond a simple read-only statistics query: it reads environment variables, accesses files under the user's home directory, writes credentials locally, and communicates with remote services. Because these capabilities are not explicitly declared, users and platforms cannot accurately assess the trust boundary or consent to the full behavior, increasing the risk of unintended credential handling and network actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is querying HS-code trade statistics, but the skill also performs account registration, credential provisioning and storage, balance checks, payment order creation, pricing retrieval, and telemetry-style error reporting. This mismatch is dangerous because it hides materially different operations—especially credential and payment flows—behind a seemingly narrow analytics skill, which can mislead users into granting trust they would not otherwise give.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key issuance, account lookup, pricing, and recharge flows, which are outside the declared HS-code trade-statistics purpose of the skill. Scope mismatch is dangerous because it expands the skill's authority into credential and billing operations that users may not expect, increasing the chance of misuse, hidden monetization, or abuse of linked accounts.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Creating recharge/payment orders is unrelated to HS-code analytics and introduces financial side effects into a data-analysis skill. Even if no payment is finalized here, generating payment URLs can steer users into unintended purchases or be abused for deceptive monetization.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Exposing account-info and API pricing capabilities broadens the skill beyond its stated analytics function and reveals operational/account data that users may not expect to share through this workflow. Such overreach increases attack surface and can facilitate profiling of balances, account identifiers, or commercial terms.

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The code can write full API request parameters and response bodies to disk in ~/.upkuajing/logs when logging is enabled, without any redaction logic. If requests or responses contain company trade data, identifiers, or other sensitive business information, local log files become a secondary exposure point that may be read by other local processes or retained longer than intended.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This file implements telemetry for reporting agent/skill errors to a platform endpoint, which is unrelated to the advertised HS-code trade-statistics functionality. In a skill context, hidden or undocumented side-channel reporting is risky because it expands data flows beyond the declared purpose and may transmit operational context that users do not expect.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The implemented behavior does not perform HS-code statistics analysis; instead, it uploads invocation error data to an external endpoint. This mismatch is dangerous because users and reviewers may trust the manifest's business purpose while the code performs a different networked function, reducing transparency and increasing the chance of undisclosed data exfiltration or policy bypass.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This module adds outbound network communication and persistent local file writes that are unrelated to the skill's stated HS-code trade analytics purpose. Even if intended for maintenance, the hidden version-check behavior expands the skill's privileges and attack surface by introducing telemetry and filesystem state without clear necessity or user consent.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The self-update/version telemetry capability is outside the declared function of a customs statistics skill and silently contacts a remote endpoint with identifying metadata. In a skill context, this is dangerous because it creates an undisclosed communication channel that could be repurposed for tracking, targeted responses, or remote control over upgrade messaging.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API documentation explicitly encourages sending request parameters, response payloads, and error context to a centralized error-reporting endpoint, while only briefly noting that sensitive fields are 'automatically masked' and giving no clear user-facing warning, minimization guidance, or strict allowlist for what may be transmitted. This creates a real privacy and data-leakage risk because stack traces, raw request data, and failed responses often contain personal data, secrets, or commercially sensitive trade information, and overcollection during failure handling is a common source of exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The recharge-order function invokes payment URL creation directly with no visible confirmation, review screen, or warning in this file. Any capability that initiates a billing workflow without explicit informed consent risks accidental charges, social engineering, or dark-pattern behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Request/response logging stores transmitted data to disk without any in-code notice, consent flow, or redaction. For a trade-statistics skill, those payloads may include commercially sensitive company and customs data, so silent persistence increases privacy and confidentiality risk beyond the live API transaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code sends user-supplied parameters including requestId, requestPath, and especially context to a remote error-report endpoint without any disclosure, redaction, or consent mechanism visible in this file. If context contains prompts, business data, tokens, or personal information from failed invocations, this creates a confidentiality risk through unintended telemetry leakage.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The HTTP request sends the skill name to a remote service without any visible user-facing disclosure in this file. While the data element is limited, the lack of transparency means users cannot reasonably assess that the skill performs telemetry, and the value can still reveal installed capabilities or usage context.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: The skill instructs access to a local secrets file and describes reading and storing an API key in ~/.upkuajing/.env. Even if intended for normal setup, this is credential access and persistence behavior; if the skill or surrounding tooling is compromised, it creates a clear path to expose, overwrite, or misuse API credentials from a predictable filesystem location.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 93% confidence
• Finding: This section explicitly says a new API key can be automatically saved to ~/.upkuajing/.env, combining credential creation with local secret persistence. Automatic writing of credentials to disk in a known path increases the blast radius of compromise and can lead to secret leakage through logs, backups, permissive file permissions, or later unintended reuse by other processes.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 83% confidence
• Finding: The code stores a freshly issued API key in a plain-text .env file under the user's home directory. Plain-text secret storage is dangerous because other local users, processes, backups, or misconfigured tooling may read the key, enabling unauthorized API use and potential billing abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 88% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including versions with breaking changes or newly introduced supply-chain risk. While not an immediate exploit by itself, unpinned dependencies reduce build reproducibility and can cause the skill to pull an unsafe or incompatible package version over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58