ClawHub
Back to skill

Security audit

查询公司海关贸易产品列表数据 — 获取产品名称的贸易次数、金额、数量和关联HS编码，用于产品组合分析。支持全球 220 多个国家和地区的海关数据。帮助外贸团队查看公司的具体贸易产品清单、量化各产品的交易规模和数量、关联分析 HS 编码——是产品维度市场分析和竞品追踪的核心数据来源。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its customs-data purpose, but it should be reviewed because it can expose or persist API keys unsafely and performs an undisclosed version-check with local caching.

Review this skill before installing. Do not let an agent print or paste the contents of ~/.upkuajing/.env; use an environment variable or protected secret store where possible, restrict the key file to owner-only access, and be aware that the skill can create API keys, query account/balance information, create recharge payment URLs, report errors to the vendor, and run a background version check when API requests are made.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

Credential Disclosure Through Secret-File Printing Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:62
Finding

API Key File Is Created Without Explicit Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Version

Content
View full analysis
=0.23.0 ``` ### Technical Analysis The dependency specification defines only a minimum version and has no upper bound, exact version, lock file, or integrity hash. As a result, installations performed with the documented `pip install -r requirements.txt` command may resolve to different versions over time. This is not evidence that the current `httpx` package is malicious. The risk is that future, incompatible, or compromised releases and changed transitive dependencies can enter the execution environment without being reviewed as part of the Skill. Because imported package code executes in the Python process, a compromised dependency would receive the same filesystem, environment-variable, and network privileges as the Skill, including potential access to `UPKUAJING_API_KEY`. ### Attack Path 1. A user installs the Skill dependencies using `pip install -r requirements.txt`. 2. The package resolver selects the latest release satisfying `httpx>=0.23.0`. 3. A future compromised or otherwise unsafe release, or one of its transitive dependencies, is installed. 4. The dependency executes during installation or when imported by the Skill. 5. The dependency runs with the privileges of the user executing the Skill and may access local files, environment variables, or network resources. This attack path depends on a malicious or compromised future package release or dependency source; no such malicious package was identified in the audited project. ### Impact Assessment If dependency resolution selects compromised code, the potential scope equals the privileges of the Python process. This could include: - Reading the API key from the environment or local credential file. - Accessing user-readable files. - Modifying files writable by the user. - Sending data ...[truncated 175 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill appears to perform version checking, local cache writes, and outbound requests for upgrade detection, none of which are disclosed by the stated purpose of returning customs product data. These hidden side behaviors are dangerous because they introduce extra network and filesystem actions that can leak metadata, persist state, or create an unexpected attack surface beyond the core user task.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill appears to perform version checking, local cache writes, and outbound requests for upgrade detection, none of which are disclosed by the stated purpose of returning customs product data. These hidden side behaviors are dangerous because they introduce extra network and filesystem actions that can leak metadata, persist state, or create an unexpected attack surface beyond the core user task.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill appears to perform version checking, local cache writes, and outbound requests for upgrade detection, none of which are disclosed by the stated purpose of returning customs product data. These hidden side behaviors are dangerous because they introduce extra network and filesystem actions that can leak metadata, persist state, or create an unexpected attack surface beyond the core user task.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill instructs reading ~/.upkuajing/.env directly, including an example using cat, which exposes secret material in plaintext. In an agent environment, encouraging direct file reads of a credential store increases the risk of secret disclosure to logs, transcripts, the model context, or an unintended user-visible response.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill directs users or the runtime to manage API keys by writing them into ~/.upkuajing/.env, coupling credential handling with a general-purpose skill flow. This is dangerous because local file-based secret storage invites accidental exposure, weakens separation of duties, and can cause secrets to be persisted in places accessible to other tools or sessions.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Automatically saving a newly issued API key to ~/.upkuajing/.env expands the skill from data retrieval into credential acquisition and persistence. This is risky because secret creation and storage are sensitive operations that can be abused or mishandled, especially when performed by a skill that is expected to only query product-trade data.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements authentication, account lookup, pricing, and recharge-order creation, which are materially outside the stated skill purpose of querying customs product-list data. This scope expansion increases attack surface and can enable unexpected financial or account-management actions through a skill that users would not reasonably expect to have those capabilities.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The script writes a newly issued API key directly into a .env file, creating plaintext local secret storage. If the home directory, backups, logs, container layers, or repo workspace are accessible to other users/processes, the key can be recovered and abused for unauthorized API use and possible billing impact.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

The error path encourages manual environment-variable handling after a failed write, which is not a vulnerability by itself, but it reinforces insecure secret-handling patterns around plaintext/local environment configuration. In practice this can lead to accidental disclosure through shell history, process listings in some environments, or misconfigured deployment files.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements a generic platform error-reporting capability rather than the declared customs product-list querying function. This expands the skill's behavior beyond its manifest and can enable unauthorized transmission of request metadata and context to a backend endpoint, which is especially risky in agent environments where hidden utility functions may exfiltrate operational data. The mismatch between manifest and implementation increases suspicion because users and reviewers would not expect this side-effect from a customs product-list skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill declares capabilities that imply environment access, local file read/write, and network use, but it does not define an explicit tool scope or permission boundary. This is dangerous because the runtime may grant broader access than the user expects, making it easier for the skill to read secrets, modify local state, or contact unrelated endpoints without clear authorization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

L003 的 Trigger 列表中包含“分页产品查询”“公司产品贸易详情”“贸易产品下钻”等表述，这些短语缺少对海关贸易数据、公司主体或特定系统上下文的限定，容易与一般数据查询类请求重叠。文件中也未提供负面示例或排除条件来说明哪些相似表述不应激活该技能。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document explicitly instructs callers to transmit request parameters, response payloads, and exception context to an error-reporting endpoint, while only stating that sensitive fields will be 'automatically desensitized' and giving no explicit user-facing warning, minimization guidance, or consent boundary. In a trade-data skill context, these fields can contain company identifiers, query contents, internal stack traces, and other potentially sensitive operational data, creating a real privacy and data-leakage risk if over-collected or improperly scrubbed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The top-level docstring and all user-facing descriptions are written only in Chinese, which constitutes a language/locale constraint in the skill's natural-language interface. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific reason.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file's natural-language descriptions and user-facing messages are consistently hard-coded in Chinese, with no indication that the user can choose another language or locale. The policy requires flagging language/locale constraints when they are imposed without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The code can log full request parameters and full API responses to local files, which may include sensitive business data, search inputs, and potentially account-related metadata. Although logging is currently disabled by default, the capability is built in and writes unredacted content to persistent storage without any sanitization, minimization, or manifest disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Manifest 将技能描述为海关产品列表查询与分析，但该公共模块除发起查询外，还创建任务目录并将元数据和结果持续写入本地文件。对查询型技能而言，网络请求是预期实现细节，但持久化任务状态和结果属于额外行为，超出了描述中体现的只读查询范围。

Content

No source excerpt is available for this finding.