Analyzes the distribution of a company’s trade partners based on customs records. Bycompany-ID lookup, it returns partner-related structures including HS-code breakdowns,product portfolios and monthly trade timelines with customs data available for more than220 countries and territories. Export teams, sourcing agents and analysts identify tradecounterparts, analyze product categories and map out supply-chain relationships. Thissolution is ideal for partner identification, product-mix analysis and trade-networkintelligence research.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:41 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent trade-data purpose, but it needs review because it handles paid API credentials, account billing flows, remote diagnostics, and automatic version checks with limited containment.

Install only if you are comfortable with this skill reading and writing an UpKuaJing API key in ~/.upkuajing/.env, making paid API calls after confirmation, creating top-up payment URLs when requested, and optionally sending diagnostic details to UpKuaJing after confirmation. Avoid approving error reports that include secrets, raw business datasets, or sensitive customer information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while instructing the agent to read environment variables, read and write files under the user's home directory, and make networked API calls. This undermines least-privilege review and informed consent because the actual capability surface is broader than what a user would expect from the manifest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The advertised purpose is trade-partner analysis, but the skill also includes account creation, balance inspection, recharge order creation, pricing queries, error reporting, and local version metadata caching. This hidden expansion of behavior increases the chance of unauthorized financial/account actions and exfiltration of operational metadata beyond the user's expected task scope.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This module adds outbound network behavior to contact a remote endpoint for version checks, which is unrelated to the stated trade-analysis function of the skill. Even though the code appears intended for update notification rather than overtly malicious behavior, it creates an unexpected data flow and trust dependency on an external service, which can leak skill usage metadata and expand the attack surface if the API base URL or remote service is compromised.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad and loosely scoped, which can cause the skill to activate in contexts where the user did not intend customs-data access or paid API use. In this skill's context, overbroad activation is more dangerous because invocation may lead to network requests, fee-incurring actions, and credential/account handling flows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly permits sending request parameters, response data, and exception context to an error-reporting API, which can easily include company identifiers, trade query inputs, returned datasets, stack traces, and other operationally sensitive data. Although it notes that sensitive fields are 'automatically desensitized,' it does not define scope, guarantees, or require user/operator consent, so overcollection and unintended data disclosure remain realistic risks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script forwards a caller-supplied `context` field to a remote endpoint without sanitization, minimization, or any disclosure/consent mechanism. If `context` contains stack traces, request payloads, identifiers, credentials, or business data, sensitive information could be transmitted off-box and stored centrally, creating privacy and data-leakage risk.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: The skill instructs the agent to inspect `~/.upkuajing/.env` for an API key and to save newly obtained credentials there automatically. Accessing and persisting secrets in a user home directory is sensitive credential handling; if the skill or surrounding runtime is compromised, it can expose or overwrite secrets and normalize agent access to local credentials.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 97% confidence
• Finding: This section continues the same credential-access pattern by directing the agent to check for and populate `~/.upkuajing/.env` with API keys. Even if intended for convenience, this behavior expands the blast radius of any compromise and creates a precedent for filesystem-based secret discovery and storage outside a hardened credential vault.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 92% confidence
• Finding: The function is designed to inspect and manage a local .env file containing an API key, which is sensitive credential material. Storing and handling secrets in plaintext under a predictable location increases the risk of accidental disclosure through weak filesystem permissions, backups, logs, or other local tooling that reads .env files.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 95% confidence
• Finding: Reading the entire .env file to extract an existing API key interacts directly with credential storage and may expose secrets more broadly within the process than necessary. The subsequent message also reveals a prefix of the existing key, which is unnecessary exposure of secret material to console output.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 97% confidence
• Finding: The code writes a newly issued API key directly to a .env file without showing any permission hardening or atomic secure file creation. This creates a durable plaintext credential on disk, which is especially risky in a skill context because the key may enable paid API access, account activity, and downstream data retrieval if the host is shared or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 84% confidence
• Finding: On failure, the code instructs the user to manually set the environment variable for the API key, which encourages ad hoc credential handling and potential leakage through shell history, process listings, or misconfigured environments. The returned env file path also discloses exact secret-storage location information, which can aid local discovery on multi-user systems.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only version constraint, which allows future major or minor releases of httpx to be installed without review. That can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerable versions into the skill's execution environment, especially if builds are not reproducible.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58