海关企业贸易伙伴分布，通过企业 ID 获取海关数据中的合作伙伴结构，包括 HS 编码明细、产品分布和月度贸易日期，支持全球 220多个国家和地区的海关贸易数据。帮助外贸团队、采购代理和分析师发掘贸易伙伴、分析产品类别并绘制供应链关系图——非常适合合作伙伴识别、产品组合分析和贸易网络情报。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:56 AM UTC
• Version: 1.0.2

Overview

This is a disclosed paid API skill for customs trade-partner analysis, with expected but sensitive credential and billing support behavior.

Install only if you are comfortable using a paid Upkuajing API key on this machine. Confirm every paid query before it runs, treat ~/.upkuajing/.env as sensitive because it stores the API key in plaintext, and avoid sending secrets or private business data in error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, local files under ~/.upkuajing, and remote network APIs. This creates a transparency and consent gap: an agent or user may believe the skill is narrowly scoped, while it can read/write credentials and perform external calls. In this context, the mismatch is risky because the skill also handles paid operations and account state, increasing the chance of unintended side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The published description says the skill analyzes customs trade-partner data, but the body instructs the agent to perform additional sensitive actions: obtaining and storing API keys, reading local credential files, checking balances, creating recharge orders, fetching pricing, reporting errors to a platform, and caching version info. These behaviors materially exceed the declared business purpose and can expose secrets, trigger charges, or send data externally without users expecting those operations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script includes API key issuance, account balance lookup, and recharge order creation, which are operational/account-management capabilities outside the declared customs partner analytics scope. Scope expansion is dangerous because it increases the blast radius of the skill, exposes billing/account surfaces to a user invoking a data-analysis skill, and can enable unintended financial or credential workflows.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The module performs outbound network access and writes a persistent local cache in a skill whose stated purpose is customs partner analytics, not software maintenance. Even if intended for normal update checks, this expands the skill's behavior beyond user-expected scope, creates an extra data flow to a remote endpoint, and can expose environment metadata such as skill name, usage timing, and configured API base URL context.

Context-Inappropriate Capability

Low

• Confidence: 74% confidence
• Finding: A self-update check is unrelated to the declared business-analysis function and introduces unnecessary external communication. While the code does not auto-update, silently contacting a server for version information still increases attack surface and may violate least-privilege and user expectation boundaries.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends a caller-supplied `context` field and request metadata to a remote endpoint without any sanitization, minimization, or user-facing notice. Exception contexts often contain sensitive data such as identifiers, request contents, stack traces, tokens, or business data, so silent transmission can cause unintended data leakage to the platform.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs the agent to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY and to obtain a new key and save it locally if absent. Reading and writing credential files is sensitive because it exposes secrets to the skill runtime and persists authentication material on disk, which may be accessible beyond the immediate task. In this skill's context, the credential is tied to paid API usage and account actions, magnifying financial and privacy risk.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the same credential-handling pattern by directing the agent to check for, collect, or generate an API key and automatically save it into ~/.upkuajing/.env. Automatic persistence of secrets in a predictable local path increases the chance of credential leakage, misuse by other tools, or unintended billing through later reuse. Because the skill also supports account and recharge flows, compromise of this key could lead to unauthorized paid API activity.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key directly into a .env file without showing any permission hardening, secure storage mechanism, or secret-management safeguards. Storing long-lived credentials in plaintext on disk can expose the key to other local users, backups, logs, or accidental inclusion in tooling, especially because this skill also handles account and billing operations.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 86% confidence
• Finding: The error path encourages manual environment-variable handling for the API key, but the broader implementation already normalizes plaintext secret handling and returns filesystem paths in messages. While not exfiltration by itself, this pattern increases the likelihood of insecure copy/paste storage, shell history exposure, and accidental disclosure during troubleshooting.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows future major or minor versions to be installed without review. This can introduce supply-chain risk through breaking changes or newly introduced vulnerable versions, and it reduces build reproducibility across environments.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196