查询公司海关贸易产品列表数据 — 获取产品名称的贸易次数、金额、数量和关联HS编码，用于产品组合分析。支持全球 220 多个国家和地区的海关数据。帮助外贸团队查看公司的具体贸易产品清单、量化各产品的交易规模和数量、关联分析 HS 编码——是产品维度市场分析和竞品追踪的核心数据来源。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:49 AM UTC
• Version: 1.0.1

Overview

This is a paid customs-data API skill with disclosed account, billing, and API-key setup flows, but users should understand the credential storage and outbound reporting/update behavior before installing.

Install this only if you intend to use the Upkuajing paid API and are comfortable storing UPKUAJING_API_KEY in a local plaintext ~/.upkuajing/.env file. Confirm each billable query or recharge-order step deliberately, and avoid including customer secrets, tokens, or sensitive raw payloads in optional error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes Python scripts that access environment variables, local files, and remote APIs, but it does not declare explicit permissions for those capabilities. This weakens transparency and sandboxing because a caller may not realize the skill can read/write credential files and perform networked side effects such as billing, account actions, and error reporting.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a product-list query tool, but the instructions also cover credential provisioning, local credential storage, account information access, recharge order creation, pricing queries, exception reporting, and version-cache behavior. This mismatch is dangerous because users or orchestrators may authorize a seemingly narrow read-only data skill while it can trigger broader account and financial actions and handle sensitive credentials.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements authentication lifecycle and billing-related operations for a skill whose declared purpose is customs product-list querying. That capability expansion is risky because it introduces account-management and financial actions unrelated to the stated user function, increasing attack surface and the chance of misuse or surprise side effects.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The ability to create recharge/payment orders is not necessary for customs product-list queries and enables a financial side effect from within the skill. In context, this is more dangerous because users invoking a data-query skill would not reasonably expect billing workflows, making abuse or deceptive triggering more plausible.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script can request a new API key and persist it locally, which exceeds the least-privilege needs of a product-query skill. In this context, bundling credential issuance into an otherwise read-oriented skill increases the chance of unauthorized account creation, credential sprawl, or silent environment modification.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module performs outbound network access and writes to a persistent local cache under the user's home directory, behavior that is not necessary for the stated customs product query function. While likely intended for update notifications, this expands the skill's trust boundary, creates undisclosed telemetry/storage behavior, and increases privacy and supply-chain risk if the endpoint or local environment is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code implements self-update discovery logic by contacting a remote API and surfacing upgrade instructions, even though the skill's business purpose is customs trade product analysis. Such hidden update/telemetry behavior is risky because it introduces an unnecessary remote dependency and can be repurposed for tracking, selective targeting, or future unsafe update flows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly instructs sending requestParams, responseData, and detailed error context to an external error-report endpoint, but it does not require user notice, consent, minimization, or strict redaction guarantees before transmission. Even though it states sensitive fields will be auto-masked, this is not a sufficient control because stack traces, raw parameters, and response payloads often contain personal data, business secrets, tokens, or other confidential content that may be exfiltrated during debugging.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script forwards request metadata and free-form context to a remote endpoint without any visible sanitization, minimization, or user-facing disclosure in this file. If callers place sensitive data, tokens, customer identifiers, or raw payload fragments into context, the reporting path can become an unintended exfiltration channel to the platform backend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The automatic version check transmits the skill name to a remote service on first daily use without any user-facing notice or consent. Even though the payload is small, it creates silent usage telemetry that can reveal installed capabilities and usage patterns, which is unjustified for a customs-query skill and problematic in regulated or privacy-sensitive environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 93% confidence
• Finding: The skill instructs reading and populating a local credential file at ~/.upkuajing/.env and allows acquisition of a new API key that is automatically written there. Handling secrets through general skill logic increases the risk of credential exposure, misuse, or unintended persistence, especially if the runtime has broad file access or logs command/output content.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 92% confidence
• Finding: This section continues the credential-handling workflow by directing the agent to inspect ~/.upkuajing/.env and manage user-provided or newly issued API keys in that file. In context, the risk is amplified because the same skill also performs billable network operations and account actions, so compromise or misuse of the key could lead to unauthorized spending and account access.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: Writing a newly issued API key into a plaintext .env file creates a local secret-at-rest exposure risk, especially if file permissions are weak, the home directory is shared, or the file is later checked into source control. In the context of a product-query skill, this is more dangerous because credential persistence is unexpected and broader than necessary for a read-only workflow.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only (`httpx>=0.23.0`), which allows installation of any newer version, including future major releases with breaking changes or newly introduced supply-chain risk. While this is not an immediate exploit by itself, it weakens build reproducibility and can cause the skill to consume an unexpected package version if the dependency ecosystem or package source is compromised.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196