Delivers monthly trade-trend insights from customs records. It pulls monthly breakdowns ofshipment frequency, product quantity, gross weight and transaction value with optionalfilters by company ID and covers customs data across 220+ countries and territories.Export teams, analysts and supply-chain managers can analyze trading patterns, trackseasonal fluctuations and monitor long-term business activities. This tool fitsmarket-trend research, supplier performance tracking and trade-flow intelligence analysis.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:39 AM UTC
• Version: 1.0.2

Overview

The skill is a disclosed paid API integration for customs trade trend queries, with some credential, billing, and telemetry-related behavior users should understand before installing.

Install only if you intend to use UpKuaJing's paid API and are comfortable storing its API key in ~/.upkuajing/.env. Confirm charges before running queries, review any top-up URL before paying, and avoid enabling raw API logging unless you are willing to keep local copies of request and response data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit permissions, yet its documentation directs access to environment variables, local files under the user's home directory, and remote network endpoints. This creates a transparency and review gap: operators may approve a seemingly simple data-query skill without realizing it can read/write credentials locally and perform external calls beyond the core query.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is monthly customs-trend lookup, but the documented behavior expands into API key provisioning, balance/account retrieval, recharge order creation, pricing lookups, error-report telemetry, and local metadata caching. This mismatch is dangerous because users and reviewers may consent to a narrow analytics function while the skill also handles credentials, payment-adjacent flows, and extra outbound communication.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs the agent to perform account-management and payment-related actions that are outside the skill's core customs-trend analysis purpose. In context, this broadens the blast radius from data retrieval into actions that can trigger account changes, billing events, or exposure of financial workflow URLs.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The error-reporting flow sends operational details such as request path, request ID, and failure context back to the platform, which is outside the core trade-analysis function. Even with user confirmation, this creates an additional telemetry channel that may leak sensitive operational metadata or user query context to a third party.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key issuance, account lookup, pricing lookup, and recharge/payment order creation, which materially exceeds the declared purpose of customs-trade trend analysis. In a skill context, unrelated billing and credential-management capabilities expand attack surface and create opportunities for unauthorized account actions or deceptive monetization flows.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Exposing recharge-order creation and pricing lookup inside a trade-analysis skill is unrelated privileged functionality that could be abused to initiate unwanted billing workflows or manipulate users into payment actions. The mismatch between stated purpose and implemented capabilities makes the behavior more suspicious and dangerous in this context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script persists an API key to a local .env file under the user’s home directory, which creates a credential-at-rest exposure and is not justified by the advertised analytical purpose. If local filesystem permissions are weak or the file is accidentally disclosed, the key could be reused to access the associated service account.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The utility code can persist full API request/response payloads and task data to local files under the user's home/skill directories. Even though API logging is disabled by default, if enabled it may store sensitive customs-trade data, company identifiers, and possibly error details without retention controls, redaction, or explicit user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The code adds a platform telemetry capability unrelated to the advertised customs-analysis purpose and automatically reports runtime exceptions to a remote endpoint. This increases the attack surface and can lead to collection of unexpected operational or user-derived data under the guise of a data-analysis skill, especially because the transmitted payload includes free-form context.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module adds network-based version checking and persistent local state to a skill whose declared purpose is customs-trade analysis. While likely intended for maintenance, it introduces out-of-scope behavior: contacting a remote endpoint, transmitting the installed skill name, and writing cache data under the user's home directory, which expands the skill's attack surface and creates privacy and governance concerns if the endpoint or distribution channel is untrusted.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill contains self-update telemetry behavior unrelated to its stated business function, sending the skill name to a server to query available versions. Even if not overtly malicious, hidden telemetry/update checks in a domain-specific skill are risky because they create covert communication paths and normalize remote control/update awareness outside the user's expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The logging helpers write raw request parameters and parsed API responses to local log files, which can capture sensitive business data and potentially authentication-related error content. There is no masking, access control enforcement, or user-facing notice at the write sites, so enabling logging increases the chance of unintended local data disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function sends `context` along with request metadata to `/agent/skill/error/report` without any disclosure or controls visible in this file. If `context` contains stack traces, request contents, identifiers, or user-provided text, sensitive information may be transmitted to a remote service unintentionally during error handling.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code transmits the installed skill name to a remote API without any visible user-facing warning, consent, or clear necessity tied to customs analysis. Although the payload is small, silent metadata exfiltration can disclose installed capabilities, aid profiling, and violate principle-of-least-surprise, especially in enterprise environments where even product-identifying telemetry may be sensitive.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill explicitly instructs checking and using a credential file in the user's home directory and supports automatically applying for and storing a new API key there. Accessing and modifying local credential stores is sensitive because it can expose secrets, overwrite existing credentials, or normalize broader filesystem access than users expect from a trade-query skill.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: The workflow continues the credential-handling pattern by directing inspection of ~/.upkuajing/.env and automatic key creation/storage, immediately followed by account top-up flows. In this context, credential access is more dangerous because it is coupled to billing-related operations, increasing the chance of unauthorized account manipulation or unintended persistence of secrets.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 93% confidence
• Finding: Writing the API key into a plaintext .env file stores a reusable credential in a location that may be read by other local processes, backups, or users with filesystem access. In the context of a skill that does not obviously need to manage secrets locally, this increases the risk of account compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is only lower-bounded (`httpx>=0.23.0`) rather than pinned to a specific version or constrained range, which can cause non-reproducible installs and unexpectedly pull in future releases with breaking changes or newly introduced security issues. In a skill that performs network access for customs/trade data retrieval, dependency drift increases supply-chain risk because HTTP client behavior is security-sensitive.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58