Provides aggregated customs-trade statistics for overseas companies. It pulls tradingfrequency, shipment weight, product quantity, transaction value and partner counts viacompany ID with customs data covering more than 220 countries and territories. It enablesexport teams, analysts and researchers to access summarized trade overviews, assesscorporate trading scale and evaluate partner networks. This tool is well-suited forsupplier screening, buyer validation and trade-intelligence analysis.

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:41 PM UTC
• Version: 1.0.1

Overview

The skill mostly matches a paid customs-statistics API integration, but it also handles plaintext API keys, account/top-up actions, and an automatic under-disclosed version check.

Review before installing. Use it only if you are comfortable storing an UpKuaJing API key in ~/.upkuajing/.env, making paid API calls only after explicit confirmation, and allowing the package to contact UpKuaJing for both queries and version checks. Avoid enabling API logging for sensitive supplier or trade research unless you accept local retention of those results.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises executable behavior that uses environment variables, reads and writes local files, and makes network calls, yet it declares no permissions. This weakens least-privilege controls and can cause the host to grant more capability than users expect, especially because the skill handles credentials and paid API operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior goes beyond a simple customs-statistics lookup and includes credential provisioning, local credential storage, account/balance inspection, payment order creation, and remote version-check activity. This mismatch is dangerous because users may invoke a seemingly narrow research skill without realizing it can manage accounts, touch secrets, and initiate fee-related workflows.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Including account-management and top-up flows inside a trade-lookup skill expands the blast radius from data retrieval into financial and credential operations. If misused, the skill could steer users into creating keys, exposing account metadata, or initiating payment flows under the guise of a lookup request.

Intent-Code Divergence

Low

• Confidence: 75% confidence
• Finding: The documentation says fee-incurring actions require explicit user confirmation in a separate message, but nearby examples show direct execution commands. That inconsistency can lead agents or users to skip the confirmation step and trigger unwanted paid API calls.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound network access and writes persistent state under the user's home directory for version tracking, which is unrelated to the stated customs-trade analytics purpose. Even if intended for maintenance, undisclosed side effects expand the skill's privileges and create a covert telemetry/update channel that could leak usage metadata or be repurposed if the remote endpoint is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A self-update/version-tracking capability is not justified by this skill's declared function and introduces persistent state, network communication, and behavioral complexity beyond business analytics. Such auxiliary control-plane features are dangerous in skills because they can bypass user expectations and serve as a foundation for tracking, remote control, or future unauthorized update logic.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match general research, supplier vetting, and trade-intelligence requests that may exceed the skill's actual narrow function. Overbroad activation increases the chance the skill is selected in contexts where users did not intend credential handling, paid queries, or account-related actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes a newly issued API key directly to a local .env file without prior confirmation and without setting restrictive permissions. On multi-user systems or misconfigured environments, secrets stored this way may be exposed to other local processes or accidentally committed, copied, or indexed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request/response logging helpers can persist full API parameters and responses to disk, which may include company identifiers, business intelligence data, or other sensitive query content. Even though logging is disabled by default, enabling it creates a quiet local data-retention channel without redaction, access controls, or user disclosure.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Task metadata and result persistence write data to disk without any visible runtime notice, creating silent local retention of potentially sensitive trade-analysis outputs. In a supplier-screening and trade-intelligence context, persisted company data may be commercially sensitive and remain on disk longer than users expect.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The version check sends the skill name to a remote API without any disclosure in this file's described purpose, creating undisclosed metadata exfiltration. While the payload is small, it still reveals installed skill usage and can aid fingerprinting or monitoring when combined with server logs and timing data.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: httpx>=0.23.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58