查询公司海关贸易港口列表数据 — 获取港口的贸易次数、金额和占比，用于物流分析。支持全球 220 多个国家和地区的海关数据。帮助外贸团队查看公司的贸易港口分布、分析物流通道的使用情况、识别核心进出口港——是供应链物流优化和贸易路线分析的重要参考。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

This skill connects to a paid trade-data API and handles setup, billing, and diagnostics in ways that are mostly disclosed and user-controlled.

Install only if you are comfortable giving this skill access to your Upkuajing API key, storing that key in ~/.upkuajing/.env, and making paid API calls after confirmation. Review any recharge/payment URL and any error report context before approving them, because diagnostics may include operational details.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly require environment-variable access, reading and writing files under ~/.upkuajing, and network/API operations. This creates a transparency and consent problem: an operator may approve a seemingly simple data-query skill without realizing it can handle credentials, create payment orders, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior substantially exceeds the stated purpose of querying port trade data: it also covers API key provisioning, local credential storage, account/balance lookup, recharge order creation, price queries, and remote error reporting. This mismatch is dangerous because users and orchestrators may grant trust for a read-oriented analytics skill while it also performs account-affecting and credential-handling actions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements API key provisioning, account inspection, recharge ordering, and pricing lookups even though the skill is described as a company customs port-list query tool. This capability expansion is dangerous because it introduces billing and credential-management behaviors unrelated to the stated business purpose, increasing the chance of unauthorized account changes, surprise charges, and hidden data flows.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Creating recharge orders is a financial side effect unrelated to port trade analysis. In the context of a data-query skill, embedded payment functionality is especially risky because it can trigger account spending paths the user would not reasonably expect from the advertised capability.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code can request a new API key from a remote service and persist it locally, which exceeds the expected scope of a port-list lookup tool. Credential issuance and storage are sensitive operations; bundling them into an unrelated skill increases exposure to secret sprawl and unauthorized long-lived access if the skill is installed or invoked inappropriately.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Account balance and interface pricing queries are administrative/billing functions, not necessary for customs port analysis. Their presence broadens the skill's access to account metadata and commercial information, which is suspicious in this context and can aid reconnaissance or misuse of the linked service account.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script sends request metadata and an arbitrary 'context' field to a remote endpoint, and that context may contain stack traces, request payload fragments, identifiers, or other sensitive operational data. In a skill whose declared purpose is trade-port analytics, this telemetry path is not clearly necessary, making undisclosed data exfiltration risk more concerning.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code performs remote exception reporting without any visible consent, notice, or disclosure mechanism in the script itself. If errors include user or system context, operators may unknowingly transmit sensitive information off-system, which is especially problematic when the skill's stated function does not imply telemetry collection.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 93% confidence
• Finding: The skill instructs reading from and writing API credentials to ~/.upkuajing/.env, including auto-saving newly issued keys. Access to local secret files is sensitive because it can expose long-lived API credentials, enable unintended reuse by other processes, or overwrite credentials without strong validation and auditability.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 91% confidence
• Finding: The account setup flow explicitly directs the agent to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY and to persist new keys there automatically. In context, this skill is not just consuming a provided secret but participating in credential discovery and management, which increases the risk of secret exposure and broadens the attack surface beyond the advertised analytics function.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 85% confidence
• Finding: The code reads an existing .env file to extract an API key in plaintext. In isolation this is expected for local configuration, but it is still a credential-handling risk because the skill directly parses and processes sensitive secrets from disk, and in this mismatched skill context that behavior is less justifiable and increases the blast radius if the package is abused or modified.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 92% confidence
• Finding: The script writes a newly issued API key directly into a .env file in plaintext. Persisting credentials this way creates a high risk of accidental disclosure through backups, logs, permissive file permissions, or other local tooling, especially since the skill is not primarily an authentication manager and users may not expect secret material to be created on install/use.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer version, including major releases with breaking changes or future vulnerable releases. This weakens reproducibility and supply-chain control, making builds less predictable and increasing the chance of pulling in a compromised or incompatible package.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The explicit require_auth=False setting disables authentication for a credential-issuance request, which is an unsafe default for a sensitive capability. In this skill context, that broadens access to account-related operations beyond what users would expect from a port analysis tool and can facilitate unauthorized or opaque provisioning behavior.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The explicit require_auth=False setting disables authentication for a credential-issuance request, which is an unsafe default for a sensitive capability. In this skill context, that broadens access to account-related operations beyond what users would expect from a port analysis tool and can facilitate unauthorized or opaque provisioning behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196