ClawHub
Back to skill

Security audit

海关企业贸易伙伴分布，通过企业 ID 获取海关数据中的合作伙伴结构，包括 HS 编码明细、产品分布和月度贸易日期，支持全球 220多个国家和地区的海关贸易数据。帮助外贸团队、采购代理和分析师发掘贸易伙伴、分析产品类别并绘制供应链关系图——非常适合合作伙伴识别、产品组合分析和贸易网络情报。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised paid customs-data lookup, but it handles API credentials and account/billing actions in ways users should review carefully before installing.

Install only if you are comfortable giving this skill access to your Upkuajing API account and paid API balance. Do not ask the agent to display `~/.upkuajing/.env`; use a presence check instead, protect that file with owner-only permissions, and review any recharge-order or error-reporting action before approving it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:69
Finding

API Key File Is Created Without Explicit Owner-Only Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Dependency Installation Is Not Reproducibly Pinned

Content
View full analysis
=0.23.0 ``` `SKILL.md`: ```text 2. **安装依赖**：`pip install -r requirements.txt` ``` ### Technical Analysis The dependency declaration specifies only a minimum version. Consequently, every installation may resolve to any later `httpx` release and to a dynamically selected set of transitive dependencies. The installation instructions do not use a reviewed lock file, exact versions, package hashes, or an isolated environment. This makes builds non-reproducible and expands the supply-chain trust boundary to future releases that were not part of this audit. No currently malicious package, typo-squatted package name, or unsafe package index was identified. The risk arises from unconstrained future dependency selection rather than confirmed malicious behavior in the declared `httpx` package. ### Attack Path 1. A user follows the documented command `pip install -r requirements.txt`. 2. The package resolver selects the newest versions satisfying `httpx>=0.23.0`, including transitive dependencies. 3. A future selected release contains a security vulnerability, compromised distribution, or incompatible behavior. 4. The affected dependency code executes during installation, import, or API requests under the privileges of the user running the Skill. 5. Depending on the dependency defect, it may access the Skill’s process data, including request parameters and the API credential available to that process. Exploitation depends on a vulnerable or compromised future package release or package-index compromise; no such payload is embedded in this repository. ### Impact Assessment Dependency code executes with the same operating-system privileges as the Skill. A compromised dependency could potentially read user-accessible files, ins ...[truncated 313 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (35)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to analyze customs trade-partner data, but its documented behavior also includes API-key provisioning, account inspection, balance handling, recharge order creation, and pricing queries. This mismatch is security-relevant because users may authorize a data-analysis skill without realizing it can also manipulate credentials and trigger account-related workflows with financial consequences.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to analyze customs trade-partner data, but its documented behavior also includes API-key provisioning, account inspection, balance handling, recharge order creation, and pricing queries. This mismatch is security-relevant because users may authorize a data-analysis skill without realizing it can also manipulate credentials and trigger account-related workflows with financial consequences.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to analyze customs trade-partner data, but its documented behavior also includes API-key provisioning, account inspection, balance handling, recharge order creation, and pricing queries. This mismatch is security-relevant because users may authorize a data-analysis skill without realizing it can also manipulate credentials and trigger account-related workflows with financial consequences.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs displaying the contents of ~/.upkuajing/.env with cat, which would expose the API key in plaintext to the agent and potentially to user-visible output, logs, or downstream tools. In this context the danger is elevated because the file is specifically described as storing the active credential used for billable API access.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

Referencing and reading a .env file that contains UPKUAJING_API_KEY creates a direct credential-access path. If the agent follows this guidance, the secret can be exposed, reused for unauthorized API consumption, or leaked into transcripts and telemetry.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The workflow tells the agent to check the local .env for the API key and supports automatically applying for and saving a new key to that file. This combines credential discovery with credential persistence, increasing the blast radius if the agent or logs are compromised and normalizing secret handling in an unsafe plaintext store.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The instruction to have users manually add keys to ~/.upkuajing/.env, or let the agent obtain and auto-save a new key there, encourages insecure secret lifecycle management. In a skill that also performs network and account actions, compromising that local file could enable unauthorized data access and billable operations.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script includes account provisioning, balance lookup, and payment-order creation capabilities that are outside the stated purpose of analyzing customs trade-partner data. Scope expansion in a skill increases attack surface and can enable unintended financial or account-management actions if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The script writes a newly issued API key into a plaintext .env file under the user's home directory. Plaintext secret storage is risky because other local users, backup systems, logs, or misconfigured permissions can expose the credential and allow unauthorized API use.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
79% confidence
Finding

On failure, the script returns the path to the secret file location, which can disclose credential storage details to callers or logs. While not exposing the key itself, revealing the exact secret path can aid local attackers or increase the chance of accidental disclosure and mishandling.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares broad capabilities implied by its workflow—reading local files, writing credential files, using environment secrets, and making network requests—without an explicit tool scope or permission boundary. That makes it harder for a runtime or reviewer to constrain behavior and increases the chance that sensitive operations such as credential handling or outbound requests occur without clear isolation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs agents to report exceptions by sending request parameters, response data, and error context to a remote API, but it does not require explicit user notice, consent, or strict minimization before transmission. Even though it states sensitive fields will be masked automatically, error context, raw request parameters, and response bodies can still contain confidential business data, identifiers, or model outputs that should not be forwarded by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module description and all user-facing help/messages in this file are presented exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Creating recharge orders and exposing pricing/account-adjacent actions are not necessary for the declared business purpose of partner analysis. In an agent ecosystem, unnecessary financial operations increase the risk of abuse, confusion, and unintended charges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code file contains natural-language content that assumes a Chinese-speaking user, beginning with the module docstring and continuing throughout user-facing strings. Under the policy, forcing a specific language without opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module title, description, CLI description, help text, and error messages are written only in Chinese, which imposes a language choice without any opt-in or alternative locale. The policy requires flagging language or locale constraints when the skill forces a specific language without user choice or an explicit justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains natural-language descriptions, argument help text, and error messages exclusively in Chinese. That imposes a fixed language/locale on users with no documented choice or opt-in, which matches the stated policy-violation category for language constraints.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196