查询日期参考信息 — 获取去年年份、上月月份、去年当月等日期参考值，用于海关贸易数据查询。提供准确的财务参考日期，支持海关数据分析和进出口贸易研究。帮助外贸团队、贸易分析师和进出口从业者获取精确的日期参数用于海关贸易查询、市场趋势分析和贸易情报研究，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:04 AM UTC
• Version: 1.0.0

Overview

This is a paid API date-reference skill with disclosed credential and billing support, but users should understand it stores an API key locally and contacts the provider.

Install only if you are comfortable using the upkuajing paid API, storing UPKUAJING_API_KEY in ~/.upkuajing/.env, and letting the skill contact openapi.upkuajing.com. Confirm fee-generating calls separately, avoid sharing the .env contents in chat or logs, and consider pinning dependencies or using a managed secret store if deploying in a shared environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares a narrow date-reference purpose, but the content instructs the agent to access environment secrets, read and modify files under ~/.upkuajing/.env, and perform networked account-management actions. Even if some of these actions are legitimate for the broader vendor workflow, the capability surface is larger than what is disclosed, which weakens user consent and increases the risk of unintended secret handling or side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a simple date-reference lookup, but it also includes workflows for API key issuance, credential storage, account inspection, recharge order creation, pricing queries, and version caching. This mismatch is dangerous because users or orchestrators may invoke the skill expecting a low-risk read-only operation while actually authorizing credential and billing-related actions with materially different security and financial consequences.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This script implements API key issuance, account lookup, pricing, and payment-order creation even though the skill is declared as a date-reference utility. That mismatch is dangerous because users or hosting platforms may grant the skill trust and permissions inappropriate for billing and credential-management operations, expanding the attack surface well beyond the advertised purpose.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file contains capability to provision API credentials and initiate recharge/payment flows that are unjustified for a date-query skill. In this context, hidden credential and payment operations are especially risky because they can surprise operators, enable unauthorized account actions, and normalize collection/storage of secrets unrelated to the promised functionality.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is described as only returning date reference values, but the implementation includes a generic external API client with authentication, network transmission, and arbitrary endpoint support. That mismatch expands the skill’s effective capability far beyond its declared purpose, enabling unexpected data egress or remote operations under the guise of a simple date helper.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file contains task persistence and local file write capabilities that are unrelated to a date-reference skill. Even if not immediately exploitable here, unnecessary write primitives increase attack surface and allow a deceptively simple skill to create or retain local state without clear user expectation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Reading API keys from environment variables and a user-home .env file is disproportionate to the stated function of returning date reference values. In context, this grants credential-access capability to a low-risk-looking skill, which is dangerous because it can silently leverage sensitive tokens for external API use.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code can log API requests and responses into files under the user’s home directory, which is not necessary for a date helper. This creates an undisclosed local data-retention channel that may capture request parameters, server responses, and potentially sensitive business data if logging is enabled.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module adds outbound network access and persistent state changes to a skill whose declared purpose is only returning date reference values. Even if framed as an update check, it creates an unexpected data flow to a remote service and writes local cache data, expanding the trust boundary and enabling tracking, environment probing, or future abuse if the endpoint or configuration is compromised.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The remote version-check capability is unrelated to the advertised date-reference functionality and therefore constitutes hidden or unjustified network behavior. In a skill context, such undeclared egress is dangerous because it can reveal installation/use metadata, create a covert communications path, and normalize unexpected remote control surfaces.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Writing a persistent cache under the user's home directory is not necessary for the stated date-query behavior and introduces side effects that users would not expect from a simple reference skill. Persistent local state can be used for tracking usage over time, leaves artifacts on disk, and increases privacy and integrity risk if the cache is tampered with or later repurposed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The logging functions write transmitted request and response data to local files without any disclosure at the write sites or evidence of sanitization. If enabled, this can persist sensitive inputs, API outputs, or identifiers in predictable locations, increasing exposure through local compromise or accidental sharing.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 83% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 86% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 91% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: httpx>=0.23.0

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196