ClawHub
Back to skill

Security audit

海关企业月度贸易趋势，通过企业 ID 获取海关数据中贸易次数、数量、重量和金额的月度明细（支持可选筛选条件），支持全球 220多个国家和地区的海关贸易数据。帮助外贸团队、分析师和供应链经理分析贸易模式、监测季节性波动并跟踪长期的贸易活动——非常适合市场趋势分析、供应商销售监控和贸易流向情报。

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the stated paid customs-data lookup, but it also includes risky credential, account, payment, telemetry, and update-check behavior that users should review before installing.

Review this skill carefully before installing. Use an environment variable or a secure secret store for the API key, do not run commands that print `~/.upkuajing/.env`, and avoid using the recharge or error-report features unless you understand what account, payment, and diagnostic data will be sent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:36
Finding

Credential Disclosure Through Documented Terminal Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–45
Vulnerability Type: API credential exposure
Risk Level: Medium

bash
cat ~/.upkuajing/.env

Technical Analysis

The Skill documentation instructs the Agent to display the complete contents of the credential file. This file contains UPKUAJING_API_KEY, which authorizes access to paid API operations.

Reading this dedicated credential for authentication is necessary for the declared functionality, but printing it is not. Running the documented command can expose the key to terminal capture, Agent context, conversation transcripts, execution logs, screen recordings, or anyone able to observe the session.

The implementation in scripts/common.py can already determine whether the key exists without exposing it, so this command exceeds the minimum access necessary for credential validation.

Attack Path

  1. A user or Agent follows the documented API-key verification procedure.
  2. The Agent runs cat ~/.upkuajing/.env.
  3. The complete API key appears in terminal output.
  4. The output is retained in a transcript, log, monitoring system, or model context.
  5. An unauthorized party with access to that output extracts the key.
  6. The party submits authenticated, potentially billable requests against the Upkuajing API.

Impact Assessment

An attacker who obtains the key gains the API privileges associated with the affected account. This may permit access to account information and customs-data endpoints, creation of billable API requests, depletion of account balance, and submission of reports under the victim's identity.

The issue does not directly provide operating-system privilege escalation; its scope is the API account represented by the disclosed credential.

Remediation
View remediation

Remediation Suggestions

  • Remove the command that prints the credential file.
  • Replace it with a non-disclosing existence check that reports only whether a nonempty UPKUAJING_API_KEY entry is present.
  • Explicitly instruct the Agent never to print, echo, log, or include the API key in conversation output.
  • Prefer supplying the key through the declared environment variable rather than reading a plaintext file.
  • If file-based storage remains supported, document owner-only permissions and provide a safe command for correcting them.
  • Redact any credential-like values from diagnostics and execution transcripts.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:72
Finding

API Key File Is Created Without Explicit Owner-Only Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 72–86
Vulnerability Type: Insecure local secret storage
Risk Level: Medium

python
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")
except IOError as e:
    return {
        "success": False,
        "envFilePath": str(env_file)
    }

Technical Analysis

A newly issued API key is written to ~/.upkuajing/.env using ordinary file creation. Neither the directory nor the credential file is assigned an explicit restrictive mode. Their effective permissions therefore depend on the process umask and existing filesystem state.

In a permissive environment, the file may be readable by the user's group or other local users. The code also does not correct insecure permissions on an existing directory or file. Opening the path with ordinary write mode does not protect against an existing symbolic link, creating an additional local filesystem manipulation risk where an attacker can influence the target path.

Because this file contains a reusable bearer credential, it should be treated as a sensitive secret and created with owner-only access.

Attack Path

  1. A user invokes auth.py --new_key.
  2. The service returns a new API key.
  3. The script creates or overwrites ~/.upkuajing/.env using permissions inherited from the process umask.
  4. On a shared system, another local account reads the file if inherited permissions allow it.
  5. Alternatively, a local attacker able to prepare the path may attempt to exploit an existing symbolic link before the write.
  6. The attacker obtains or redirects the API credential and uses it for authenticated API requests.

Impact Assessment

Successful exploitation exp ...[truncated 422 chars]

Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with mode 0700 and verify or correct the mode if it already exists.
  • Create the credential file atomically with mode 0600, rather than relying on the ambient umask.
  • Reject symbolic links and non-regular files before writing. On supported systems, use secure open flags such as O_NOFOLLOW, O_CREAT, and O_EXCL.
  • Write to a securely created temporary file in the same directory, flush and synchronize it, then atomically replace the destination.
  • Validate ownership before reading or replacing an existing credential file.
  • Prefer a platform credential manager or secret store when available.
  • Avoid returning or logging any portion of the key; even the existing prefix disclosure should be removed or replaced with a non-secret identifier.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency Produces Non-Reproducible Installations

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned dependency version
Risk Level: Low

text
httpx>=0.23.0

Technical Analysis

The dependency specification accepts every future httpx release at or above version 0.23.0. Consequently, installing the Skill at different times can retrieve materially different code that was not part of the audited package.

No evidence indicates that httpx is currently malicious or that dependency confusion is actively present. The risk is that unrestricted future resolution weakens reproducibility and expands the supply-chain trust boundary. A compromised, incompatible, or unexpectedly changed future package version could execute within the same Python process as the Skill.

Attack Path

  1. A user follows the documented installation command using requirements.txt.
  2. The package index resolves a newer release than the version originally reviewed.
  3. That release contains a security regression, incompatible behavior, or compromised package content.
  4. The dependency is imported by scripts/common.py and scripts/version_check.py.
  5. The new code executes with the privileges of the user running the Skill and participates in authenticated network requests.

Impact Assessment

A compromised dependency could theoretically access the API key available to the process, read or modify files available to the invoking user, alter request or response data, or make arbitrary network connections. The practical likelihood is reduced because the named package is legitimate and no current malicious release was identified.

The confirmed issue is the absence of reproducible dependency controls, not evidence of an existing malicious dependency.

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to a specifically reviewed version.
  • Generate and commit a lock file containing exact transitive dependency versions.
  • Use package hashes and require hash verification during installation.
  • Regularly update dependencies through a controlled review and testing process.
  • Run dependency vulnerability scanning in continuous integration.
  • Install dependencies in an isolated virtual environment with only the permissions needed by the Skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (37)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates additional update-check and local cache/version-file behavior beyond the declared customs analytics purpose. Hidden update checks and local state writes increase the attack surface by enabling unexpected network egress and persistence in the user environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates additional update-check and local cache/version-file behavior beyond the declared customs analytics purpose. Hidden update checks and local state writes increase the attack surface by enabling unexpected network egress and persistence in the user environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates additional update-check and local cache/version-file behavior beyond the declared customs analytics purpose. Hidden update checks and local state writes increase the attack surface by enabling unexpected network egress and persistence in the user environment.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill instructs reading ~/.upkuajing/.env and even shows cat ~/.upkuajing/.env, which risks exposing the full API key contents to the agent or user output. Direct access to secret-bearing files violates least exposure and can lead to credential leakage, account misuse, and downstream billing abuse.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The workflow tells the agent to inspect a local .env for UPKUAJING_API_KEY and, if absent, apply for a new key and save it automatically. This combines credential discovery, issuance, and persistence in one flow, which magnifies the risk of unauthorized secret handling and long-lived local compromise.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The instructions continue to normalize reading and writing the .env file containing the API key, reinforcing unsafe credential handling practices. In this context, the skill is more dangerous because it also has network and billing-related behavior, so leaked credentials could immediately be used for account queries, paid API calls, or recharge-related actions.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements account/authentication management, API key issuance, balance lookup, and recharge functions that are outside the stated purpose of a customs-trends analysis skill. This expands the skill's capabilities into credential and payment operations, increasing attack surface and enabling unintended account actions if the skill is invoked in a broader agent environment.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

This line writes an API key to a .env file in plaintext, creating a local credential exposure risk. In the context of a skill that should primarily perform trade analysis, embedding secret persistence on disk makes the capability more dangerous because it mixes analytics with credential management.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Creating recharge orders is unrelated to monthly trade-trend analysis and introduces financial-operation capability into a data-query skill. In an agent context, this can be abused to trigger unwanted billing flows or payment links, making the mismatch especially risky.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares capabilities that imply reading environment variables, local files, writing files, and making network requests, but it does not declare any explicit tool scope or allowed-tools policy. This weakens least-privilege controls and makes it harder for a host agent or reviewer to constrain sensitive operations such as credential access, local persistence, and outbound requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation instructs the agent to perform credential setup, account management, billing, and exception reporting workflows that go beyond simple trade-trend retrieval. Combining these operational flows into one skill broadens the consequences of misuse and increases the chance of unauthorized sensitive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill authorizes creation of recharge orders and directing users to payment URLs, which is a billing capability unrelated to the narrow analytics description. Payment initiation is financially sensitive and can be abused for unauthorized charges, phishing-like redirection, or coercive upsell if not strongly isolated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Line L145 states '禁止输出技术参数格式' and requires converting parameter displays into natural language, while the entire skill description and examples are written only in Chinese with no indication that the user may choose another language. This creates a language/locale policy concern because the skill appears to impose Chinese-language interaction by default rather than offering a user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The API documentation explicitly encourages sending request parameters, response payloads, and exception context to a centralized error-reporting endpoint. Even though it states that sensitive fields will be automatically masked, it does not define what is considered sensitive, guarantee complete redaction, or warn users to avoid including secrets, personal data, or commercially sensitive trade data in these fields. In the context of a customs/trade analysis skill, these payloads may contain enterprise transaction details, identifiers, and operational metadata, making unintended data exfiltration through logging more dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file's user-facing description and all CLI/output messages are presented only in Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should either be optional for the user or clearly documented as justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script exposes API key creation and account balance retrieval, which are not necessary for analyzing customs-company trends. Even if intended for setup, bundling credential lifecycle and account data access into the skill increases exposure of sensitive operations and makes misuse more likely.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196