ClawHub
Back to skill

Security audit

查询公司海关贸易港口列表数据 — 获取港口的贸易次数、金额和占比，用于物流分析。支持全球 220 多个国家和地区的海关数据。帮助外贸团队查看公司的贸易港口分布、分析物流通道的使用情况、识别核心进出口港——是供应链物流优化和贸易路线分析的重要参考。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the advertised paid customs-port lookup, but it also handles API keys and account/payment support in ways users should review carefully before installing.

Review this before installing if the API account has funds or sensitive trade data access. Use a dedicated low-balance API key if possible, avoid printing ~/.upkuajing/.env, check local file permissions, and only approve paid queries, recharge URL creation, or error reports when you intend them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:63
Finding

API Key Stored and Displayed Without Adequate Local Protection

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Installation

Content
View full analysis
=0.23.0 ``` From `SKILL.md:20`: ```markdown 2. **安装依赖**：`pip install -r requirements.txt` ``` ### Technical Analysis The dependency specification provides only a lower version bound. It permits the package resolver to install any future release of `httpx`, together with dependency versions selected at installation time. No lockfile, exact version constraint, package hashes, or reviewed transitive dependency set is provided. There is no evidence that `httpx` is a typosquatted or intentionally malicious package. The risk arises because future installations are not reproducible and can resolve to package versions that were not part of this audit. A compromised upstream release, compromised transitive dependency, or incompatible future version could execute installation-time code or alter runtime networking and TLS behavior. The documentation instructs users to perform the installation directly and does not require an isolated virtual environment. ### Attack Path 1. A user follows the setup instruction and runs `pip install -r requirements.txt`. 2. The resolver selects the latest release satisfying `httpx>=0.23.0`, along with currently available transitive dependencies. 3. A future compromised or otherwise unsafe release is selected because no upper bound, lockfile, or hash constrains the package. 4. Package installation or import-time code executes with the privileges of the user running `pip`. 5. The compromised component may access data available to that process, including the API key when the Skill later invokes authenticated requests. ### Impact Assessment Impact depends on the privileges used for installation and execution. In a typical user-scoped or virtual-environment installation, a compromised dep ...[truncated 498 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill reportedly performs version checks, reads local metadata, writes cache files under ~/.upkuajing, and emits upgrade notices—behaviors unrelated to querying port-trade data. These side behaviors increase hidden network and filesystem activity and make the skill more dangerous than its declared business function suggests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill reportedly performs version checks, reads local metadata, writes cache files under ~/.upkuajing, and emits upgrade notices—behaviors unrelated to querying port-trade data. These side behaviors increase hidden network and filesystem activity and make the skill more dangerous than its declared business function suggests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill reportedly performs version checks, reads local metadata, writes cache files under ~/.upkuajing, and emits upgrade notices—behaviors unrelated to querying port-trade data. These side behaviors increase hidden network and filesystem activity and make the skill more dangerous than its declared business function suggests.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill instructs reading ~/.upkuajing/.env directly, including a literal cat command, to access the API key. Encouraging direct file reads of a secret-bearing env file creates clear credential exposure risk: the key could be printed, logged, echoed back to users, or mishandled by the agent beyond the minimum needed for authentication.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The workflow explicitly tells the agent to inspect the local .env file for UPKUAJING_API_KEY and supports writing user-provided secrets into that file. This combines credential discovery and local secret storage in a general-purpose skill, which increases the chance of secret leakage, persistence beyond user intent, and compromise of other tools that trust that file.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

At this line the skill combines verification of a local secret file with instructions for manual insertion or automatic persistence of a newly issued API key. In the context of a skill supposedly meant for trade-port queries, this is especially dangerous because it normalizes credential access and storage operations that are unrelated to the narrow business query and could be abused to harvest or persist secrets.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file implements account management, API key issuance, and recharge/payment workflows that are outside the declared purpose of a port-trade lookup skill. This kind of scope mismatch is dangerous because users or host agents may grant trust based on the advertised data-query function, while the code quietly enables credential provisioning and billing-related actions.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

Reading an existing .env file to inspect API keys means the skill handles secrets directly from local plaintext storage. In the context of an unrelated analytics skill, direct secret access increases the blast radius of compromise and may expose credentials through logs, errors, or unintended code paths.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Writing a newly issued API key into a local .env file stores a live credential in plaintext on disk. This is dangerous because local files are commonly leaked through backups, misconfigured permissions, debugging, or accidental check-in, and the skill context does not justify embedded credential persistence for a simple trade-query function.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

Returning the environment file path in error handling increases disclosure about where credentials are expected to be stored, which can aid post-compromise secret targeting. While not severe by itself, combined with plaintext .env storage it contributes to easier discovery and harvesting of sensitive material.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The presence of recharge-order creation in a logistics-analysis skill introduces unnecessary financial capability. Even if intended for legitimate account funding, embedding payment-related actions in an unrelated skill expands attack surface and increases the risk of unauthorized charges or social engineering through a trusted analytical interface.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a skill for querying company customs trade port list data for logistics analysis, but this file implements a separate capability: reporting runtime exceptions to a platform endpoint. That telemetry/error-reporting behavior is not part of querying or analyzing port trade data and represents functionality outside the manifest's stated scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares capabilities that imply environment access, filesystem interaction, and network use, but it does not explicitly scope or constrain those powers with an allowlist. That creates an over-privileged execution model where a seemingly simple data-query skill can also access local secrets or perform unrelated remote actions, increasing the blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The listed triggers include short noun phrases such as “海关港口列表” and “公司贸易港口详情,” but the file does not define when these phrases should activate this skill versus related customs/company analysis skills. There are no negative examples or scope constraints, which increases the chance of unintended invocation for adjacent logistics or trade-analysis requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document explicitly allows sending request parameters, response payloads, and free-form error context to an error-reporting endpoint. Even though it states that sensitive fields are 'automatically desensitized,' it does not define coverage, guarantees, or a requirement to minimize data before submission, so secrets, personal data, trade data, or stack traces could still be exposed to the platform. In a customs/logistics skill, those fields may contain commercially sensitive import/export information, making the reporting path a meaningful data-leak channel.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module documentation advertises API-key application and recharge features that conflict with the externally stated port-query purpose. This discrepancy is a security concern because misleading capability descriptions make it harder for reviewers and users to understand the true privilege and financial scope of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code can request a new API key and persist it locally, which is unrelated to simple port-list querying and creates credential-handling risk. In this context, hidden credential lifecycle management is dangerous because it normalizes secret generation/storage in a skill users may only expect to perform read-only trade analysis.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains natural-language documentation and console messages exclusively in Chinese, beginning with the module docstring and continuing throughout user-facing output. Under the policy, forcing a specific language without offering the user a language/locale choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196