Delivers monthly trade-trend insights from customs records. It pulls monthly breakdowns ofshipment frequency, product quantity, gross weight and transaction value with optionalfilters by company ID and covers customs data across 220+ countries and territories.Export teams, analysts and supply-chain managers can analyze trading patterns, trackseasonal fluctuations and monitor long-term business activities. This tool fitsmarket-trend research, supplier performance tracking and trade-flow intelligence analysis.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

The skill mostly does what it claims, but it handles API keys and payment-related account actions in ways users should review carefully before installing.

Review this skill before installing if you use a funded UpKuaJing account. Do not run commands that print `~/.upkuajing/.env`, avoid pasting API keys into chat or logs, and be cautious with `auth.py --new_key` and `auth.py --new_rec_order` because they create persistent credentials and payment-related URLs. Prefer setting the API key through a safer secret mechanism and verify file permissions if you use the local `.env` path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

API Key Disclosure Through Full Credential File Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API Key Stored Without Explicitly Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependency Installation

Content

View full analysis

=0.23.0 ``` The dependency is installed through the following documented command: ```markdown 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The dependency specification accepts every `httpx` release from version 0.23.0 onward. It does not define an upper bound, an exact reviewed version, a locked transitive dependency set, or package hashes. Consequently, installations performed at different times can resolve to different code without any modification to this Skill. A future incompatible, vulnerable, or compromised release accepted by the range could be downloaded and imported into the Skill's Python environment. No evidence was found that the currently named package is a typosquat or that a malicious package is presently included. The risk arises from unrestricted future resolution and the absence of integrity verification. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` instruction. 2. Pip resolves the newest package versions satisfying `httpx>=0.23.0`, along with their transitive dependencies. 3. A future vulnerable or compromised compatible release is selected without requiring a change to the Skill package. 4. The package is installed in the Python environment. 5. The dependency code executes when the Skill imports or uses `httpx`. 6. Malicious or vulnerable dependency behavior runs with the privileges of the user executing the Skill. ### Impact Assessment Dependency code runs with the same local privileges as the Python process. A compromised dependency could potentially access the API key available through the environment or `~/.upkuajing/.env`, inspect query parameters and responses, alter network requests, modify user-accessible files, or execut ...[truncated 166 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description centers on trade analytics, yet the detected behavior includes remote version checks, local cache reads/writes, and upgrade notifications unrelated to the primary task. While not inherently malicious, undocumented updater/telemetry behavior expands the trust boundary and can introduce unnecessary network and filesystem access paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description centers on trade analytics, yet the detected behavior includes remote version checks, local cache reads/writes, and upgrade notifications unrelated to the primary task. While not inherently malicious, undocumented updater/telemetry behavior expands the trust boundary and can introduce unnecessary network and filesystem access paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description centers on trade analytics, yet the detected behavior includes remote version checks, local cache reads/writes, and upgrade notifications unrelated to the primary task. While not inherently malicious, undocumented updater/telemetry behavior expands the trust boundary and can introduce unnecessary network and filesystem access paths.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs reading the entire ~/.upkuajing/.env file via cat to obtain an API key. Directly accessing and potentially exposing a plaintext credential file is dangerous because it can leak secrets unrelated to the immediate operation and normalize unsafe secret-handling practices.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The workflow directs the agent to check for an API key in a local .env file and, if missing, obtain and automatically save a new key there. This combines credential discovery with credential creation and local persistence, increasing the risk of unauthorized secret handling, accidental disclosure, and long-lived plaintext storage.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The instructions encourage checking a plaintext credential file and saving a newly created API key back into that file automatically. In the context of a trade-analysis skill, this is especially risky because the secret-handling behavior is ancillary to the main purpose and may occur under user expectations of a simple data lookup.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements API-key lifecycle, account lookup, pricing, and recharge-order creation for a skill whose declared purpose is customs-trade trend analysis. While not an exploit by itself, the mismatch expands the skill’s privilege and financial surface beyond user expectations, increasing the chance of misuse, unintended billing actions, and supply-chain abuse.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The code reads an existing .env file, extracts the API key, and includes part of that key in a user-facing message. Even partial secret disclosure can leak identifying material into logs, terminals, screenshots, or telemetry and makes secret handling weaker than necessary.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code writes a newly issued API key into a .env file under the user’s home directory, which is a plaintext storage mechanism unless additional protections are applied. If the file permissions are weak, backed up insecurely, or exposed to other local processes, the credential can be stolen and abused.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Creating recharge/payment orders is a financial capability unrelated to customs-trend analytics and introduces a direct billing action into the skill. If invoked unexpectedly or by a compromised workflow, it could initiate unwanted payment flows, facilitate social engineering, or expose users to fraudulent top-up activity.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for retrieving monthly customs-trade breakdowns and analyzing seasonal or long-term trade trends by company ID. This file instead collects invocation metadata and sends exception reports to a platform endpoint, which is operational telemetry rather than customs-data analysis behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises executable capabilities that include environment access, file read/write, and network use, but it does not declare any explicit tool scope or permissions boundaries. That creates an over-privileged execution model where a consumer cannot easily tell what the skill is allowed to access, increasing the chance of unintended credential/file exposure or network actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file presents all user-facing instructions and API reference text exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language descriptions and user-facing messages exclusively in Chinese, including the module docstring and CLI help text, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

API key provisioning is an account-management function that exceeds the declared analytics-only scope of the skill. Bundling credential issuance into a data-analysis skill increases attack surface and can normalize silent credential creation in contexts where users expect read-only analytics behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function returns multiple end-user status and error messages only in Chinese, and there is no mechanism for locale selection or user opt-in. This can violate language/locale policy because the skill enforces one language for operational messaging.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

The explicit require_auth=False setting for API key creation signals a permissive default for a security-sensitive operation. In the context of a skill that should primarily analyze trade data, this expands abuse potential and makes unauthorized credential generation more concerning.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

The explicit require_auth=False setting for API key creation signals a permissive default for a security-sensitive operation. In the context of a skill that should primarily analyze trade data, this expands abuse potential and makes unauthorized credential generation more concerning.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes getting monthly customs-trade breakdowns and analyzing trends, which implies querying and processing data, but this utility module also persists arbitrary outputs and task metadata to local files and per-task directories. Local persistence may be useful for implementation, yet the code exposes a broader task-management and result-storage subsystem than the manifest description suggests.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58