Query paginated port trade data for a company — retrieve port-level trade statistics with counts,amounts, and percentages for logistics analysis. Supports paginated port queries, companytrade port details, import-export port analysis and trade logistics drill-down acrossglobal customs data.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:43 AM UTC
• Version: 1.0.1

Overview

This is a disclosed paid UpKuaJing API wrapper for company port-trade queries, with expected account, billing, and error-report helper flows that require user confirmation.

Install only if you are comfortable using a paid UpKuaJing API. Confirm fees before every query or top-up flow, keep the ~/.upkuajing/.env API key private, and avoid sending raw request or response bodies in error reports unless you are sure they contain no sensitive business data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit permissions, yet the documented behavior requires environment access, reading and writing files under the user's home directory, and making network requests. This creates a transparency and least-privilege problem: users and reviewers cannot accurately assess the skill's actual capabilities before use, increasing the chance of unintended credential access or external data transmission.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a trade-port query tool, but it also performs account provisioning, billing/top-up flows, pricing retrieval, error reporting, credential storage, and version checks. This mismatch is dangerous because users may consent to a simple data query while the skill also handles secrets, payment-related actions, and external reporting, expanding the attack surface far beyond the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication, account lookup, API pricing, and recharge/payment functions even though the skill is presented as a read-only company port-trade analytics tool. This scope mismatch is dangerous because users or platforms may grant trust appropriate for analytics while the code can initiate account-management and billing-related actions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The new_rec_order function creates recharge orders, which is unrelated to paginated port-trade analysis. In the context of a data-query skill, embedding a payment workflow materially increases risk of unauthorized charges, deceptive behavior, or abuse of user trust.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing/payment capability is unjustified by the stated purpose of port-list analytics and represents an unnecessary privileged action. In this context, the mismatch makes the behavior more suspicious because users would not reasonably expect a logistics analytics skill to create recharge orders.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code can apply for a new API key and persist it locally, which exceeds the narrow purpose of querying port-trade data. While key management can be legitimate, bundling issuance and storage inside a read-only analytics skill broadens the attack surface and can lead to unintended credential creation or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 74% confidence
• Finding: The script sends error data to a platform endpoint and auto-populates skill identity metadata, but the skill description does not disclose telemetry or justify collection of failure context. If the context field contains request payloads, identifiers, or other sensitive business data, this creates an undocumented data egress path that can expose user or operational information.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This module performs outbound network access and writes persistent local cache data that are unrelated to the skill’s declared business function of querying port-trade statistics. Even though the behavior appears to be for update checking rather than overtly malicious activity, hidden side effects expand the skill’s attack surface, create undeclared data flows, and can be abused if the configured API base URL is untrusted or compromised.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file introduces self-update detection and upgrade prompting behavior that does not align with the manifest’s stated purpose of trade-data query and logistics analysis. Functionality drift like this is risky because users and reviewers may authorize the skill for one purpose while it silently performs unrelated actions, reducing transparency and making future abuse easier to hide.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly instructs callers to submit request parameters, response payloads, and exception context to an error-reporting endpoint. Although it mentions automatic masking of sensitive fields, it does not define what is considered sensitive, require minimization, or warn users against including secrets, personal data, or full stack traces that may contain tokens or business-sensitive trade data. In a skill handling company trade and customs-related queries, these fields can easily contain commercially sensitive information or authentication material, making overcollection and unintended disclosure a realistic risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script writes a newly issued API key directly to a local .env file without an explicit confirmation prompt or permission hardening. This can expose credentials to other local users, backups, or tooling that ingests environment files, especially if file permissions are left at insecure defaults.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The request/response logging helpers can persist API parameters and full response bodies to local log files, which may include sensitive company trade data, identifiers, or billing information. Although logging is disabled by default, enabling it creates silent local data retention without sanitization, access controls, or user-facing disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code forwards requestPath, requestId, and especially free-form context to '/agent/skill/error/report' without any user-facing notice, consent, or visible redaction step. In a trade-data skill, error context may include company names, query parameters, internal identifiers, or API responses, so silent reporting can leak sensitive operational or customer data to the platform.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The version check transmits the skill name to a remote API without any visible notice or consent flow. While the data sent is limited, undisclosed outbound telemetry violates least surprise and can reveal locally installed capabilities or usage context, especially when combined with server logs or IP metadata.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 90% confidence
• Finding: The skill instructs access to a sensitive file in the user's home directory and supports automatically saving API keys there. Accessing and modifying credential stores is security-sensitive because it can expose secrets, overwrite existing configuration, or normalize unsafe secret handling patterns, especially in a skill whose primary purpose is not credential management.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 88% confidence
• Finding: This section continues the credential-handling flow by directing checks for UPKUAJING_API_KEY and enabling automatic persistence of a newly created key into ~/.upkuajing/.env. In context, this increases risk because the skill couples routine business queries with secret acquisition and storage, which can lead to unauthorized credential access or inadvertent leakage if the environment or file contents are exposed.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 80% confidence
• Finding: This code reads the local .env file to inspect whether an API key already exists. Although this is not clear credential theft, it is credential access behavior and increases sensitivity because the skill handles secrets outside its declared analytics purpose.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 93% confidence
• Finding: This line opens the .env file for writing and stores an API key in plaintext, which is a form of credential handling with exposure risk. In the context of a trade-analytics skill, storing secrets locally is more dangerous because it is unrelated to the advertised read-only purpose and may surprise users.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any newer httpx release, including versions with breaking changes or newly introduced vulnerabilities. This weakens reproducibility and can expose the skill to supply-chain risk if an unsafe upstream version is resolved during installation or deployment.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58