T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:37- Finding
Unsafe API Key Disclosure and Insufficient Secret File Permission Enforcement
- Content
View full analysis
- Remediation
View remediation
Security audit
Analyzes the distribution of a company’s trade partners based on customs records. Bycompany-ID lookup, it returns partner-related structures including HS-code breakdowns,product portfolios and monthly trade timelines with customs data available for more than220 countries and territories. Export teams, sourcing agents and analysts identify tradecounterparts, analyze product categories and map out supply-chain relationships. Thissolution is ideal for partner identification, product-mix analysis and trade-networkintelligence research.
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real UpKuaJing customs-data skill, but it handles API keys, paid queries, and account top-up flows in ways users should review before installing.
Install only if you are comfortable with a paid UpKuaJing API workflow. Do not let the agent print your .env file or API key into chat or logs, protect ~/.upkuajing/.env with restrictive permissions, require explicit confirmation before fee-incurring queries or top-up order creation, and avoid sending sensitive business data in error reports unless needed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned Third-Party HTTP Dependency
- Content
View full analysis
=0.23.0 ``` The installation instruction in `SKILL.md:20` is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency constraint permits any `httpx` release at or above version 0.23.0, with no upper bound, exact lock, or package hash. As a result, the code reviewed during this audit may run with a materially different future package version and different transitive dependencies. No evidence of dependency confusion, typosquatting, or an intentionally malicious package was found. `httpx` is a legitimate package. The risk arises from allowing unreviewed future releases and transitive dependency changes to enter the execution environment automatically. This configuration also prevents reproducible installations. A newly released incompatible version could alter TLS, proxy, redirect, timeout, or request behavior relied upon by the Skill. ### Attack Path 1. A user follows the documented setup process and runs `pip install -r requirements.txt`. 2. pip resolves the newest package and transitive dependency versions satisfying `httpx>=0.23.0`. 3. The resolved versions may differ from those originally reviewed or tested. 4. If an allowed future release or one of its transitive dependencies is compromised, malicious installation-time or runtime code executes with the privileges of the user installing or running the Skill. 5. Even without compromise, an incompatible release may weaken expected network behavior or cause unsafe operational failures. This attack path depends on a future upstream or package-distribution compromise; no currently malicious dependency was identified in the audited project. ### Impact Assessment The potential impact is bounded by the privileges of the Python environment and u ...[truncated 505 chars]- Remediation
View remediation
``` 2. Generate a lock file that includes all transitive dependencies. 3. Require package hashes during installation, for example by using a hash-checked requirements file and installing with: ```bash pip install --require-hashes -r requirements.lock ``` 4. Regularly update the lock file through a controlled dependency-review process rather than allowing automatic installation of arbitrary future releases. 5. Run dependency vulnerability scanning in continuous integration and review security advisories before updating pinned versions. 6. Where appropriate, use a controlled package index or repository mirror to reduce exposure to package-index and dependency-resolution attacks. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior includes remote update checks, reading local metadata, and writing a version cache file under the user's home directory, none of which are part of the stated trade-analysis purpose. This is risky because it silently adds persistence, network communication, and local state changes that broaden attack surface and can be abused for tracking, tampering, or unexpected outbound requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior includes remote update checks, reading local metadata, and writing a version cache file under the user's home directory, none of which are part of the stated trade-analysis purpose. This is risky because it silently adds persistence, network communication, and local state changes that broaden attack surface and can be abused for tracking, tampering, or unexpected outbound requests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior includes remote update checks, reading local metadata, and writing a version cache file under the user's home directory, none of which are part of the stated trade-analysis purpose. This is risky because it silently adds persistence, network communication, and local state changes that broaden attack surface and can be abused for tracking, tampering, or unexpected outbound requests.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill instructs reading the entire ~/.upkuajing/.env file via cat to obtain an API key. Directly reading and potentially exposing a secrets file is dangerous because it normalizes credential access beyond the minimum necessary and may leak additional secrets present in the file to logs, model context, or downstream tools.
- Content
This skill requires an API key. The API key is stored in the
~/.upkuajing/.envfile:bash cat ~/.upkuajing/.envExample file content:
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill's setup flow directs the agent to check for and potentially manipulate a local secrets file, and to obtain a new API key that is automatically saved there. Combining credential discovery, issuance, and local persistence in a general-purpose skill increases the risk of secret leakage, unauthorized key creation, and expansion of long-lived credentials on the host.
- Content
md ### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The documented workflow encourages checking a local .env file and storing newly created credentials in it, which creates unnecessary exposure of authentication material on disk. In this context the danger is elevated because the skill also performs networked, fee-incurring, and account-related actions, so compromise of the API key could enable unauthorized queries or account misuse.
- Content
md First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file implements account provisioning, account info retrieval, pricing lookup, and recharge/payment flows inside a skill advertised as customs trade analytics. That mismatch materially expands the skill's privilege and commercial surface area beyond its stated purpose, creating an opportunity for unnecessary credential handling and financial actions that users would not reasonably expect from an analytics skill.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The function explicitly checks for and uses a local .env file to manage an API key, indicating direct credential access/handling within the skill. Handling secrets in ad hoc local files is risky because such files are often weakly permissioned, accidentally committed, or exposed through logs and support workflows.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Reading the .env file contents into memory and parsing for an existing API key means the skill directly accesses stored credentials. This expands exposure of secrets to the script's execution context and any downstream error, debug, or output path that may inadvertently disclose credential material.
- Content
python env_file = UPKUAJING_ENV_FILE if env_file.exists(): # 读取现有的 .env 文件 try: with open(env_file, 'r', encoding='utf-8') as f: content = f.read()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The code writes the newly issued API key directly to a .env file, persisting a sensitive secret in plaintext on disk. Plaintext local persistence creates durable compromise risk from local malware, backups, shared accounts, accidental publication, or insufficient filesystem permissions.
- Content
python "envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
Although this line is in an error message path, it reinforces manual environment-variable based secret handling and returns the env file path to the caller. Exposing secret storage locations can aid follow-on attacks or increase the chance that operators mishandle credentials outside protected channels.
- Content
python except IOError as e: return { "success": False, "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。", "envFilePath": str(env_file) }
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The recharge-order function creates payment URLs even though the skill's declared purpose is supply-chain and customs analysis. Embedding payment initiation in an unrelated skill increases the risk of deceptive monetization, accidental charges, or abuse if invoked by an agent or user who expected only data analysis behavior.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env_file() -> Dict[str, str]: """ 从 ~/.upkuajing/.env 文件加载环境变量。 Returns: 环境变量字典
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env_file() -> Dict[str, str]: """ 从 ~/.upkuajing/.env 文件加载环境变量。 Returns: 环境变量字典
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env_file() -> Dict[str, str]: """ 从 ~/.upkuajing/.env 文件加载环境变量。 Returns: 环境变量字典
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises executable behaviors that involve environment access, reading and writing files under the user's home directory, and making network requests, but it does not declare any explicit tool scope or permission boundaries. That creates an overbroad execution surface where a caller may invoke credential, telemetry, update-check, and billing-related actions without clear least-privilege constraints or user-visible authorization expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger language is broad and ambiguous, increasing the chance the skill is invoked in contexts broader than intended. Because this skill can touch credentials, billing/account flows, telemetry, and network operations, overbroad activation materially increases the chance of unintended sensitive actions being suggested or performed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly instructs sending request parameters, response payloads, and error context to a platform error-reporting endpoint, and only notes that sensitive fields are 'automatically masked' without defining scope, user notice, consent, or data-minimization controls. In a skill that processes trade/company data, these fields can easily contain customer queries, identifiers, business-sensitive records, or stack traces, creating a real privacy and confidentiality leakage risk if forwarded wholesale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file’s user-facing description and CLI help/messages are entirely in Chinese, which imposes a language choice on users with no opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script applies for a new API key and persists it locally, but those actions are not justified by the skill's stated analytics purpose and introduce unnecessary secret lifecycle management. Unneeded credential creation and storage increase the attack surface for secret leakage, unauthorized API use, and user confusion about what the skill is allowed to do.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
Using require_auth=False on the key-creation endpoint normalizes an insecure security posture for a sensitive operation. In the context of a trade-analytics skill, this is especially unjustified because credential issuance is ancillary behavior and should be more tightly controlled, not less.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
Using require_auth=False on the key-creation endpoint normalizes an insecure security posture for a sensitive operation. In the context of a trade-analytics skill, this is especially unjustified because credential issuance is ancillary behavior and should be more tightly controlled, not less.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file's docstring and surrounding user-facing text are written exclusively in Chinese, and later functions emit Chinese-only messages to users. The file does not indicate that language is configurable or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience, which can violate a language/locale policy requiring user opt-in or documented justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes pulling and mapping customs trade data by company ID, which implies remote querying and analysis. This shared utility code also persists request/response logs under ~/.upkuajing/logs and later task-management helpers write task metadata/results to local files, introducing local data-storage behavior not reflected in the description.
- Content