Provides aggregated customs-trade statistics for overseas companies. It pulls tradingfrequency, shipment weight, product quantity, transaction value and partner counts viacompany ID with customs data covering more than 220 countries and territories. It enablesexport teams, analysts and researchers to access summarized trade overviews, assesscorporate trading scale and evaluate partner networks. This tool is well-suited forsupplier screening, buyer validation and trade-intelligence analysis.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:39 AM UTC
• Version: 1.0.2

Overview

This skill is a paid UpKuaJing customs-statistics API helper with disclosed credential, billing, and support flows, but users should handle its API key and error-report content carefully.

Install only if you are comfortable using UpKuaJing's paid API. Keep UPKUAJING_API_KEY private, avoid printing or sharing ~/.upkuajing/.env, confirm any fee-incurring query or top-up action before it runs, and do not include secrets, personal data, or sensitive business details in error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly require reading environment variables, accessing local files, writing credentials to disk, and making network calls. This creates a transparency and governance gap: users and hosting platforms may authorize the skill under false assumptions and expose secrets or filesystem access without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is a narrow customs-statistics lookup, but the skill also performs account lifecycle actions, pricing/balance retrieval, payment order creation, local credential storage, error reporting, and version metadata caching. This scope expansion is dangerous because users invoking a data lookup skill may unknowingly trigger sensitive account, billing, or telemetry actions beyond the advertised function.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements API-key lifecycle management, account-balance retrieval, and payment-related functions that materially exceed the skill’s declared purpose of customs-trade statistics lookup. This expands the attack surface into credential and billing operations, making misuse or unauthorized invocation more damaging than a read-only intelligence skill.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Recharge-order creation is a payment capability unrelated to supplier screening or trade-intelligence analysis, so its presence indicates unnecessary privileged functionality. If exposed through an agent skill, it could be abused to trigger billing workflows, facilitate social engineering, or enable unauthorized financial actions.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code provisions fresh API keys and stores them locally even though the skill’s advertised function is data lookup, not credential administration. Embedding key-issuance logic in a broadly accessible skill increases the chance of unauthorized credential creation and proliferation.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The code sends `requestId`, `requestPath`, and especially free-form `context` to an external endpoint without any evidence here of sanitization, minimization, or disclosure. In an agent setting, error context often contains prompts, user inputs, tokens, stack traces, or business data, so undisclosed telemetry can leak sensitive information off-scope from the advertised customs-statistics function.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound version-check requests and writes persistent local cache data that are unrelated to the skill’s declared customs-trade analysis function. Even if intended for maintenance, this creates undisclosed side effects, expands the attack surface, and introduces telemetry-like behavior that users may not expect from a data lookup skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill contains self-update/version-discovery functionality that is not necessary for its stated purpose. Such hidden update discovery can be abused for tracking installations, dependency on remote infrastructure, or later coupling to unsafe update mechanisms, making it a security-relevant design issue even without direct code execution here.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The API documentation explicitly encourages sending request parameters, response payloads, and exception context as part of error reports, while only briefly stating that sensitive fields are 'automatically masked' and providing no clear constraints on what must never be included. In practice, stack traces, raw request data, and failed responses often contain API keys, tokens, personal data, or commercially sensitive trade information, so this creates a realistic risk of over-collection and secondary exposure through logging, storage, or support access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: `make_request('/agent/skill/error/report', params)` transmits caller-supplied `params`, including `context`, to a remote service with no warning or consent mechanism visible in this file. If upstream callers include raw exception text or request details, this can expose confidential user or system data through diagnostic reporting.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The code sends the skill name to a remote API without any visible disclosure or consent at the call site. While the transmitted data is limited, it still leaks usage metadata and confirms local installation/execution of the skill, which is privacy-sensitive and unnecessary for the core customs-statistics function.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: The skill explicitly instructs checking and using `~/.upkuajing/.env` for API credentials and supports automatically saving a newly issued key there. Encouraging credential discovery and persistence in a general user home directory increases the chance of secret exposure, unauthorized reuse by other tools, and accidental leakage through logs, prompts, backups, or broad file access.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 96% confidence
• Finding: This flow continues the credential-handling pattern by telling the agent to determine whether the key exists, solicit the user for one if absent, or auto-provision and save one locally. That combines secret collection, secret persistence, and account provisioning in a single skill flow, increasing exposure and making credential misuse more likely if the skill or environment is compromised.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: Writing a newly issued API key into a local .env file creates persistent plaintext secret storage, which can be exposed through weak filesystem permissions, backups, logs, or accidental inclusion in tooling. In the context of a user-facing skill, automatic local secret persistence is riskier because it normalizes credential handling outside a dedicated secure setup flow.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 87% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any newer httpx release. This can lead to non-reproducible builds and accidental uptake of a vulnerable or breaking version if a compromised or insecure release is published later. In this skill, httpx is a network-facing library, so dependency drift has some security relevance, though the file itself does not indicate active exploitation.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 87% confidence
• Finding: The explicit require_auth=False setting establishes an unsafe default for a sensitive operation: generating credentials. In a skill whose stated purpose is customs-statistics lookup, unauthenticated credential issuance is especially unjustified and increases the danger of exposing privileged platform access beyond intended use.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 87% confidence
• Finding: The explicit require_auth=False setting establishes an unsafe default for a sensitive operation: generating credentials. In a skill whose stated purpose is customs-statistics lookup, unauthenticated credential issuance is especially unjustified and increases the danger of exposing privileged platform access beyond intended use.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58