海关企业基础贸易统计，通过企业 ID 查询海关数据中该企业的贸易次数、重量、数量、金额及合作伙伴数量，支持全球 220多个国家和地区的海关贸易数据。帮助外贸团队、分析师和研究人员获取汇总的贸易摘要，评估企业贸易规模，以及评价合作伙伴网络——非常适合供应商筛选、买家验证和贸易情报分析。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate paid customs-data API skill, but it needs review because it stores a paid API key locally and has under-disclosed update and reporting behavior.

Install only if you are comfortable with a paid Upkuajing API workflow that stores its API key in ~/.upkuajing/.env, contacts openapi.upkuajing.com, and performs an automatic version check. Protect the .env file, confirm every billable call separately, and avoid sending sensitive business details in optional error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require reading environment variables, reading and writing files under ~/.upkuajing, and making network calls. This mismatch undermines consent and review because operators may approve a seemingly low-privilege skill that can actually access credentials, persist data locally, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The stated purpose is a company trade-stat lookup, but the skill also performs account management, API key issuance and storage, billing/price lookup, recharge order creation, remote error reporting, and version checking with local caching. This broad hidden behavior increases attack surface and can lead to credential handling, unintended purchases, or data exfiltration outside the user’s expected workflow.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module adds outbound network communication and persistent local state unrelated to the advertised customs statistics functionality. While version checking is a common maintenance feature, performing it implicitly during API use expands the skill's behavior surface, creates unnecessary telemetry, and could be abused if the configured API endpoint is untrusted or redirected.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The self-update/version telemetry logic is not justified by the declared analytics purpose of the skill, so it represents hidden secondary behavior. Such undeclared remote-check capability increases supply-chain and privacy risk because it can contact external infrastructure and influence user behavior through upgrade prompts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs callers to include error context plus optional requestParams and responseData in a remote error-reporting API, but it does not provide a clear warning or strict guidance to avoid sending sensitive business data, personal data, credentials, or model inputs/outputs. Although it says sensitive fields will be auto-masked, that is not a sufficient guarantee because masking rules may be incomplete and the context field can still leak secrets, customer data, or internal traces.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The script automatically writes a newly issued API key to a local .env file without an explicit confirmation step or validation of file permissions. On multi-user systems or misconfigured environments, this can lead to unintended credential exposure or persistence in a location the user did not consciously approve.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends request metadata and a free-form context field to a remote platform endpoint, but there is no visible minimization, redaction, consent, or warning mechanism. If the context or request fields contain user data, tokens, prompts, or sensitive operational details, the skill could exfiltrate information to the platform during error handling, which is especially risky because failures often include rich debug content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends the skill name to a remote API without any user-facing notice, consent, or configuration guard. Even though the transmitted field is limited, it still constitutes telemetry about installed or executed capabilities and may expose operational metadata to a third party.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs access to ~/.upkuajing/.env and supports automatic creation and storage of a new API key in that file. Accessing and persisting credentials in a local dotfile exposes secrets to unintended disclosure or reuse, especially when combined with undeclared file and env capabilities.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: The workflow goes beyond checking for a key and authorizes obtaining a new API key and automatically saving it to ~/.upkuajing/.env. This is sensitive credential lifecycle handling embedded in a data-query skill, increasing the risk of unauthorized secret provisioning, persistence, and later misuse.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 83% confidence
• Finding: Writing an API key to a plaintext .env file creates a recoverable local secret that may be exposed through weak filesystem permissions, backups, logs, or accidental inclusion in archives. Because this file handles authentication material, insecure local storage increases the chance of credential compromise if the host is shared or poorly configured.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only (`httpx>=0.23.0`), which allows installation of any newer version, including future releases with breaking changes or newly introduced supply-chain risk. While this is common and not inherently malicious, it weakens build reproducibility and can cause the skill to pull an unreviewed package version during installation.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196