ClawHub
Back to skill

Security audit

海关企业基础贸易统计，通过企业 ID 查询海关数据中该企业的贸易次数、重量、数量、金额及合作伙伴数量，支持全球 220多个国家和地区的海关贸易数据。帮助外贸团队、分析师和研究人员获取汇总的贸易摘要，评估企业贸易规模，以及评价合作伙伴网络——非常适合供应商筛选、买家验证和贸易情报分析。

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised customs statistics query, but it also handles API keys, paid account actions, telemetry, and update checks with unsafe or under-disclosed credential handling.

Review this skill before installing. Do not let an agent print `~/.upkuajing/.env`; only check whether the required key exists. Use a dedicated, least-privilege API key, protect the file with owner-only permissions, confirm every paid action separately, and avoid sending raw business data or secrets in error reports.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:36
Finding

Credential File Disclosure Through Documented Output Command

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:61
Finding

API Key Stored Without Enforced Owner-Only File Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Version

Content
View full analysis
=0.23.0 ``` The installation instructions execute: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency declaration specifies only a lower bound. It permits pip to install any later `httpx` release and whichever transitive dependency versions are selected at installation time. No lock file or package hashes are provided. Consequently, the installed dependency graph can change after the Skill has been reviewed. This increases supply-chain and compatibility risk because future releases have not been assessed as part of this audit. The package name is legitimate, and no typosquatted package or suspicious package source was identified. The issue is the lack of reproducible version and integrity controls, not evidence that the current package is malicious. ### Attack Path 1. A user follows the Skill instructions and installs dependencies. 2. Pip resolves the newest versions permitted by the lower-bound constraint. 3. A future compromised, malicious, or incompatible release is selected even though it was not reviewed with the Skill. 4. Package installation or subsequent import executes or loads the affected dependency code. 5. That code runs with the privileges of the user executing the Skill. ### Impact Assessment A compromised dependency could theoretically access the same files, environment variables, network resources, and API credentials available to the Skill process. An incompatible update could also cause request-handling failures or security regressions. Actual exploitation requires a compromised or vulnerable permitted dependency release; no such specific release was established during this static audit. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates auxiliary behavior such as remote version checks, local cache reads/writes, and parsing local skill files, none of which are part of the declared customs-statistics purpose. These hidden background actions expand the trust boundary and introduce unnecessary file and network access that could expose metadata or enable silent changes in runtime behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates auxiliary behavior such as remote version checks, local cache reads/writes, and parsing local skill files, none of which are part of the declared customs-statistics purpose. These hidden background actions expand the trust boundary and introduce unnecessary file and network access that could expose metadata or enable silent changes in runtime behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates auxiliary behavior such as remote version checks, local cache reads/writes, and parsing local skill files, none of which are part of the declared customs-statistics purpose. These hidden background actions expand the trust boundary and introduce unnecessary file and network access that could expose metadata or enable silent changes in runtime behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill instructs reading the entire ~/.upkuajing/.env file with cat, which can expose the API key and any other secrets stored in that file to the agent output or logs. In this context, the danger is elevated because the skill itself also performs paid API actions and account operations, so disclosure of the key could directly enable unauthorized usage and billing.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill directs the agent to inspect a local secret file and, if no key exists, to request creation of a new API key that will be automatically saved to ~/.upkuajing/.env. This combines secret discovery, credential issuance, and local persistence in a single workflow, which is risky because it can create or overwrite credentials on the user's system beyond the expected scope of a trade-stats query.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Automatically saving newly issued API keys into a plaintext local .env file creates a persistent credential exposure risk, especially on shared systems or in environments with loose file permissions, backups, or logging. Because this skill also supports billing-related and account-related actions, compromise of that key could lead to unauthorized charges and access to account data.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file implements account-management behavior such as API key issuance, account information retrieval, recharge order creation, and pricing lookup, which is materially outside the declared purpose of a customs trade statistics skill. This scope mismatch increases supply-chain and trust risk because a user invoking a data-analysis skill may unknowingly trigger credential provisioning or billing-related actions.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
76% confidence
Finding

The script writes a newly issued API key directly to a .env file in the user's home configuration directory without showing any permission hardening or secure storage controls. If the file permissions are weak or the host is shared, this can expose reusable credentials to other local users or backup/sync tooling.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

The error path returns and may print the full environment file path associated with secret storage, which can aid local reconnaissance, and the surrounding logic normalizes plaintext secret handling in .env. In the context of an unrelated statistics skill, exposing secret-storage details is unnecessary and increases risk if outputs are logged or surfaced to untrusted parties.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

技能清单声明该技能用于调取海关进出口数据并整理企业贸易统计，但此文件实现的是向平台上报 Agent/Skill 异常信息，请求路径为 /agent/skill/error/report。该行为属于平台遥测/运维支持，而不是企业贸易统计查询或汇总，和技能对外宣称的核心功能存在明显偏离。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares capabilities that clearly involve reading environment variables, accessing local files, writing configuration, and making network calls, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent runtime will execute sensitive operations without clear user-visible constraints or policy enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill name, description, headings, examples, and operating instructions are entirely in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all user-facing instructions and API documentation solely in Chinese, with no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly instructs agents to send request parameters, response data, and exception context to a remote error-reporting endpoint. Even though it states that sensitive fields are automatically redacted, it does not define what is redacted, require minimization, or warn operators that stack traces, request payloads, and response bodies may still contain personal, commercial, or secret data. In a customs/trade-statistics skill, these fields can plausibly contain company trade data, identifiers, and operational details, making unintended data disclosure a realistic privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description and all user-facing help/messages in this file are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. Under the policy, language-specific behavior is a violation unless the skill offers a choice or clearly justifies the locale restriction.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script exposes recharge-order and pricing operations in a skill meant for customs company statistics, creating unjustified financial functionality. Even without direct code injection, this broadens the attack surface and can lead to unexpected charges or abuse if the skill is invoked in an automated agent context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language documentation and user-facing output in Chinese, beginning with the module docstring, and the pattern continues throughout the file. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196