ClawHub
Back to skill

Security audit

海关企业月度贸易趋势，通过企业 ID 获取海关数据中贸易次数、数量、重量和金额的月度明细（支持可选筛选条件），支持全球 220多个国家和地区的海关贸易数据。帮助外贸团队、分析师和供应链经理分析贸易模式、监测季节性波动并跟踪长期的贸易活动——非常适合市场趋势分析、供应商销售监控和贸易流向情报。

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paid API lookup skill with sensitive but user-directed account helpers; users should mainly watch for plaintext API-key storage and the automatic version check.

Install only if you are comfortable with a paid Upkuajing API workflow that reads or stores an API key in ~/.upkuajing/.env, contacts openapi.upkuajing.com, and can create recharge payment links when you ask it to. Keep the API key private, review charge confirmations carefully, and do not include secrets or sensitive customer data in optional error reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions, yet its documented behavior clearly includes reading environment variables and local files, writing credential files, and making network requests. This undermines transparency and informed consent because operators may approve a seemingly simple data-query skill without realizing it can access secrets and modify local state.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is customs trend lookup, but the skill also performs credential provisioning, local credential storage, account/billing operations, price lookup, and remote error reporting. This broadens the trust boundary significantly: users invoking a market-intelligence skill may unintentionally authorize account-affecting or data-sharing actions unrelated to the core query.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script exposes account information and creates recharge orders, capabilities that are unrelated to the declared purpose of customs company trend analysis. This scope mismatch increases risk because a user may unknowingly run billing-related operations under the guise of a data-analysis skill, enabling unintended financial actions or disclosure of account balances.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The file header and implemented behavior show authentication and platform billing management rather than customs trade trend retrieval described in the skill metadata. This is dangerous because users and downstream systems may trust the skill for one purpose while it performs unrelated privileged operations, violating least surprise and expanding attack surface.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This module performs outbound network access to a remote version-check endpoint and writes persistent state under the user's home directory, even though the skill's declared purpose is customs trade trend analysis. That mismatch increases supply-chain and privacy risk because unrelated side effects occur automatically during runtime and could expose metadata or create a covert update/telemetry channel if the configured API base URL is untrusted or compromised.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code posts the skill name to a server-side API to discover newer versions, which constitutes self-update telemetry unrelated to the stated analytics function of the skill. Even though the transmitted field is small, such runtime telemetry can be used to enumerate installed skills and support tracking or targeted supply-chain actions if centralized infrastructure is abused.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The request/response logging functions write full transmitted data structures to disk under the user's home directory, which can capture sensitive business query parameters, API responses, and potentially regulated trade data. Although logging is currently disabled by default, enabling it creates a local data leakage risk because there is no field redaction, retention policy, permission hardening, or user-facing warning at the logging points.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code forwards a caller-supplied `context` field and request metadata to `/agent/skill/error/report` without any visible minimization, redaction, or user-facing notice. If `context` contains stack traces, request payloads, credentials, customer identifiers, or trade data, sensitive information could be exfiltrated to a remote platform during error handling, making failures a covert data-transfer path.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The file sends the skill name to a remote API without any user-facing notice or consent mechanism in this module. While the data exposure is limited, undisclosed outbound requests are still a privacy and transparency issue, especially in a business-analysis skill where users would not reasonably expect telemetry unrelated to customs data processing.

Credential Access

High
Category
Privilege Escalation
Content
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
97% confidence
Finding
The skill instructs checking `~/.upkuajing/.env` for an API key and can automatically apply for a new key and save it locally. Accessing and writing credential files is sensitive because it exposes secrets to the skill runtime and creates durable local credentials that could be misused by the skill or other processes if storage is not tightly controlled.

Credential Access

High
Category
Privilege Escalation
Content
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
96% confidence
Finding
This section continues the same credential-access behavior by directing the skill to inspect local secret storage and optionally provision and persist a new API key. In the context of a trade-data lookup skill, this is more dangerous because credential lifecycle management is outside the user’s likely expectation and increases the chance of secret exposure, unauthorized account creation, or silent state changes on disk.

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
83% confidence
Finding
The script writes a newly issued API key into a plaintext .env file under the user's home directory. Plaintext secret storage increases the chance of credential compromise through weak file permissions, backups, accidental inclusion in archives, or other local disclosure paths.

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
95% confidence
Finding
The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer version, including future major releases with unreviewed behavior changes or newly introduced supply-chain risk. While this is not an immediate exploit by itself, it weakens build reproducibility and can cause the skill to consume a vulnerable or incompatible version in different environments.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196