Query paginated product trade data for a company — retrieve product names with trade counts,amounts, quantities, and associated HS codes for product-mix analysis. Enables paginatedproduct queries, company product trade details, import-export product breakdown and tradeproduct drill-down for comprehensive product portfolio understanding.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:50 AM UTC
• Version: 1.0.1

Overview

This skill is a paid UpKuaJing customs-data API helper with disclosed credential, billing, and support flows, though users should be careful with local API-key storage and optional reporting.

Install only if you intend to use UpKuaJing's paid API. Keep the API key in ~/.upkuajing/.env private, confirm any fee-incurring query or top-up action before running it, and review any optional error report so it does not include sensitive business data or secrets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly require reading environment variables, accessing local files under ~/.upkuajing, writing credentials to disk, and making network requests. This creates a transparency and policy-enforcement gap: a host may allow the skill under the assumption it is low-risk, while it can actually access secrets and perform external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a product-trade query tool, but the workflow also includes account provisioning, balance checks, payment order creation, price queries, and external error reporting. That mismatch is dangerous because users may consent to a data lookup while the skill can trigger financially sensitive or privacy-relevant side operations they would not reasonably expect.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This script implements authentication management, API key provisioning, account balance retrieval, pricing lookup, and recharge-order creation, which exceed the declared purpose of a company product-trade query skill. In a skill ecosystem, adding billing and account-administration capabilities broadens the attack surface and can enable unauthorized account changes or financial actions if the skill is invoked unexpectedly or trusted too broadly.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create recharge/payment orders through /agent/auth/pay/url, which is unrelated to the stated trade-query purpose. Financial-operation capability inside a data-query skill is dangerous because it may trigger billing workflows without the user's clear expectation, and compromise of the skill or misuse of its interface could lead to fraudulent or unauthorized payment actions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The new_key workflow provisions fresh API keys and stores them locally, which is an account-administration function not justified by a product-list query skill. Even if intended for convenience, automatic key issuance increases risk of unauthorized account enrollment, uncontrolled credential sprawl, and accidental exposure of newly created secrets.

Context-Inappropriate Capability

Low

• Confidence: 74% confidence
• Finding: make_request performs an undocumented side network call via check_and_notify(API_BASE_URL) before every API request. Extra outbound communication beyond the stated product-query purpose increases attack surface, can leak environment or usage metadata, and may contact code paths users did not consent to.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This module performs outbound network access and writes persistent local cache data even though the skill is described as a customs product-query tool, making the behavior unrelated to the declared function. Hidden side effects like telemetry/version beacons broaden the trust boundary, can leak usage metadata, and create an unexpected persistence mechanism that users may not anticipate.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file implements a self-update/version-discovery capability unrelated to the stated customs data retrieval purpose, which is a supply-chain and transparency concern. Even without direct code execution, undisclosed update discovery can be used to track deployments, influence operator behavior with upgrade prompts, and normalize hidden network functionality in a data-query skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs agents to report exceptions by sending request parameters, response data, and error context to a remote API. Even though it notes that sensitive fields will be auto-masked, it does not clearly require minimization, explicit user/operator notice, or prohibit inclusion of confidential business data, stack traces, or personal data in free-form fields such as context, creating a real data-sharing/privacy risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function sends a caller-supplied `context` field and request metadata to `/agent/skill/error/report` without any sanitization, minimization, or disclosure to the user. In an agent setting, exception context can easily contain prompts, user inputs, tokens, stack traces, or business data, creating a real risk of unintended sensitive-data exfiltration to a telemetry service.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The version check sends the skill name to a remote endpoint without any user-facing notice or confirmation. Although the transmitted data is limited, this still creates undisclosed metadata leakage about installed capabilities and invocation patterns, which is more concerning because it is not part of the skill's advertised purpose.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: The skill instructs reading the user's ~/.upkuajing/.env file and using the API key stored there, and also supports automatically creating and saving a new key locally. Accessing and persisting credentials in a general-purpose local file increases the risk of secret exposure, unintended reuse, and abuse by other skills or processes with filesystem access.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 92% confidence
• Finding: This section continues the same credential-handling pattern by checking for UPKUAJING_API_KEY in a local file and then offering workflows that store or manage that credential outside a dedicated secret-management boundary. In the context of an agent skill, this makes credential access more dangerous because the skill also has network capability and can act on behalf of the user once the secret is available.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 93% confidence
• Finding: Writing a newly issued API key directly into a plaintext .env file under a predictable directory creates credential exposure risk. Local plaintext secret storage can be read by other processes, accidentally committed, backed up insecurely, or exposed via lax filesystem permissions, making compromise of the API account more likely.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer release, including future major or minor versions that may introduce breaking changes or newly disclosed vulnerable transitive dependency combinations. While this is not an immediate exploitable flaw by itself, it weakens supply-chain reproducibility and can cause the skill to pick up unsafe or untested versions over time.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 91% confidence
• Finding: The explicit require_auth=False setting establishes an unsafe default for a sensitive operation: issuing credentials. In the context of a trade-query skill, exposing unauthenticated credential creation is especially unjustified because the skill's purpose is read-only data access, not open enrollment or identity lifecycle management.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 91% confidence
• Finding: The explicit require_auth=False setting establishes an unsafe default for a sensitive operation: issuing credentials. In the context of a trade-query skill, exposing unauthenticated credential creation is especially unjustified because the skill's purpose is read-only data access, not open enrollment or identity lifecycle management.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58