Provides aggregated customs-trade statistics for overseas companies. It pulls tradingfrequency, shipment weight, product quantity, transaction value and partner counts viacompany ID with customs data covering more than 220 countries and territories. It enablesexport teams, analysts and researchers to access summarized trade overviews, assesscorporate trading scale and evaluate partner networks. This tool is well-suited forsupplier screening, buyer validation and trade-intelligence analysis.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.0.2

Overview

This skill performs the advertised paid customs-data lookup, but it also handles API keys, account billing, payment-order creation, telemetry, and automatic version checks in ways users should review before installing.

Review this before installing if you are uncomfortable with a skill reading or writing an API key in a plaintext home-directory file, creating payment top-up orders, sending confirmed diagnostic reports to the provider, or making automatic version-check calls. Use a dedicated environment, protect ~/.upkuajing/.env with owner-only permissions, avoid pasting or displaying the key, and confirm any paid query or recharge action explicitly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API Key Stored Without Explicitly Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py:63-74
Vulnerability Type: Plaintext credential storage with permissions dependent on the process umask
Risk Level: Medium

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The Skill stores the bearer API key in plaintext at ~/.upkuajing/.env. Neither the containing directory nor the credential file is explicitly assigned owner-only permissions. Their effective permissions therefore depend on the process umask and any permissions already present on the paths.

On a system with a permissive umask, the file may be created as readable by the local group or other users. If the directory or file already exists with permissive permissions, mkdir(..., exist_ok=True) and opening the file with mode w do not reliably correct those permissions.

The file operation also follows symbolic links. If an attacker with relevant local filesystem access can prepare the path before key creation, the absence of symlink checks could cause the key to be written through an attacker-controlled link.

Reading this specific credential is necessary for authenticated Skill functionality, and the audit found that it is sent only as a Bearer header to the fixed HTTPS API origin. The issue is therefore not the credential's legitimate use, but its insufficiently hardened local storage.

Attack Path

1. The victim runs python scripts/auth.py --new_key.
2. The platform returns a new API key.
3. The script creates ~/.upkuajing and writes .env without explicitly setting modes `0 ...[truncated 972 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the credential directory with owner-only permissions:

   python

   UPKUAJING_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
   os.chmod(UPKUAJING_DIR, 0o700)
   

2. Create the credential file atomically with mode 0600, using flags such as O_CREAT, O_WRONLY, O_TRUNC, and O_NOFOLLOW where supported.
3. Explicitly apply os.chmod(env_file, 0o600) after creation and verify the resulting ownership and mode.
4. Reject symbolic links and non-regular files before writing. Use lstat() or platform-appropriate secure file-opening APIs.
5. Avoid overwriting unrelated entries in an existing .env file. Parse and update only the designated key while preserving other content securely.
6. Prefer an operating-system credential store or secret manager when available.
7. Document key revocation and rotation procedures in case local disclosure is suspected.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Permits Unreviewed Future Releases

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Non-reproducible dependency resolution without integrity hashes
Risk Level: Low

text

httpx>=0.23.0

The installation instruction that activates this dependency resolution is present at SKILL.md:20:

bash

pip install -r requirements.txt

Technical Analysis

The dependency specification uses an open-ended lower bound and provides neither an upper bound nor a reviewed lockfile. Consequently, installation may select any future httpx version accepted by the resolver, along with varying versions of its transitive dependencies.

The package name is legitimate and no typosquatting or dependency-confusion package was identified. Nevertheless, the configuration makes builds non-reproducible and permits code that was not part of this audit to enter the execution environment later.

Python package installation can execute package build logic when a source distribution is selected. Even when wheels are used, compromised or malicious runtime dependency code can execute when imported by the Skill.

Attack Path

1. A future permitted release of httpx or one of its unconstrained transitive dependencies becomes compromised, malicious, or otherwise unsafe.
2. The user follows the documented command pip install -r requirements.txt.
3. The package resolver selects the affected release because httpx>=0.23.0 allows it and no integrity hashes constrain the artifacts.
4. Malicious build logic may execute during installation, or malicious runtime logic may execute when the Skill imports httpx.
5. The dependency code runs with the privileges of the user operating the Skill.

This is a supply-chain exposure rather than evidence that the currently named package is malicious. Exploitation depends on a compromised dependency release, package index, or installation channel.

Impact Assessment

Compromised depende ...[truncated 503 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin httpx to a specific reviewed version rather than using an open-ended lower bound.
2. Generate a lockfile containing exact versions of all transitive dependencies.
3. Record and verify artifact hashes, and install with pip's --require-hashes option.
4. Regularly update pinned versions through a controlled dependency-review process.
5. Run vulnerability and provenance checks against every locked package.
6. Install dependencies inside an isolated virtual environment under a non-privileged user.
7. Use a trusted package index or an internally controlled package mirror where appropriate.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates behavior beyond the stated trade-data purpose, including update/version checks, local metadata/cache access, and network calls unrelated to the customs query itself. Even if operationally useful, undocumented auxiliary network and filesystem activity expands attack surface and can expose system metadata or introduce supply-chain style risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates behavior beyond the stated trade-data purpose, including update/version checks, local metadata/cache access, and network calls unrelated to the customs query itself. Even if operationally useful, undocumented auxiliary network and filesystem activity expands attack surface and can expose system metadata or introduce supply-chain style risks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates behavior beyond the stated trade-data purpose, including update/version checks, local metadata/cache access, and network calls unrelated to the customs query itself. Even if operationally useful, undocumented auxiliary network and filesystem activity expands attack surface and can expose system metadata or introduce supply-chain style risks.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly instructs reading the ~/.upkuajing/.env file, which is a credential store containing the API key. Directing an agent or user workflow to access raw secret files increases the risk of accidental secret disclosure, logging, prompt leakage, or reuse of credentials outside their intended boundary.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This workflow tells the agent to check for an API key in a local .env file and to facilitate adding a user-provided key or auto-applying for a new one saved locally. That combines credential discovery, acquisition, and persistence in a general-purpose skill, materially increasing the chance of secret mishandling and unauthorized local credential modification.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The instruction to auto-save a newly issued API key into ~/.upkuajing/.env creates persistent local credential state from within a skill whose declared purpose is data lookup. Persisting secrets to user home directories without a dedicated secure-storage mechanism or clear permission boundary can expose credentials to other processes, backup systems, or later unintended reads.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script adds account management, API key provisioning, balance lookup, recharge-order creation, and pricing operations that materially exceed the skill’s declared customs-trade analytics purpose. In an agent ecosystem, undeclared billing and credential-management capabilities increase the attack surface and can enable unauthorized account changes, spend initiation, or covert resource enrollment if invoked unexpectedly.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Writing a newly issued API key in plaintext to a .env file creates a local secret-exposure risk, especially on shared systems or where file permissions are weak. Storing long-lived credentials unencrypted increases the chance of credential theft by other local processes, users, backups, or accidental disclosure.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a skill for fetching aggregated customs-trade statistics and assessing company trade scale and partners, but this file implements exception telemetry reporting to a platform endpoint instead of any customs-data lookup or analysis behavior. While support code can exist, this operation is a distinct platform-observability function that is not part of the user-facing customs intelligence capability described in the manifest.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions despite instructing use of environment variables, local file reads/writes, and networked scripts. This creates an over-privileged and opaque execution model where an agent may access credentials or perform network actions beyond what users expect from a simple customs-statistics lookup skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly permits sending raw request parameters, response payloads, and error context to a centralized error-reporting endpoint. Even though it states sensitive fields will be automatically masked, it does not define what is considered sensitive, does not warn operators to avoid including secrets or personal data in context strings, and encourages transmission of potentially broad diagnostic data that may contain customer, partner, or token-related information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains the skill description and CLI help text entirely in Chinese, with no indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Creating recharge/payment orders is a financial operation unrelated to trade-statistics lookup, so its presence is a risky hidden capability. Even if it only returns a payment URL, it can trigger billing workflows, confuse users about the skill’s scope, and be abused by an agent or wrapper that invokes it without clear consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The command description, argument help text, and runtime error messages are all Chinese-only. Because the file does not provide user language selection or justify a locale restriction, this constitutes a language-policy issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a data-retrieval skill for customs-trade statistics and partner assessment. While network access to the vendor API is expected, code that pulls secrets from process environment and ~/.upkuajing/.env introduces a credential-handling capability that is not stated in the skill purpose and goes beyond the business-analysis function itself.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The helper can persist full API request parameters and response bodies to local log files under the user's home directory when logging is enabled, without any masking or consent flow. Those payloads may contain company identifiers, search terms, trading counterparties, or account-related metadata, creating unnecessary local data retention and possible privacy or commercial-sensitivity exposure.

Content

No source excerpt is available for this finding.