查询日期参考信息 — 获取去年年份、上月月份、去年当月等日期参考值，用于海关贸易数据查询。提供准确的财务参考日期，支持海关数据分析和进出口贸易研究。帮助外贸团队、贸易分析师和进出口从业者获取精确的日期参数用于海关贸易查询、市场趋势分析和贸易情报研究，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.1

Overview

The skill appears to support a real paid API workflow, but it needs review because it handles API keys insecurely and performs some under-disclosed network and cache behavior.

Review this skill before installing if you will use a real Upkuajing account. Do not paste or print the full API key in chat or logs, restrict permissions on ~/.upkuajing/.env if you use it, confirm every paid query or recharge-order action, and avoid sending secrets, personal data, or full payloads in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API credential file is created without explicitly restrictive permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 62-74
Vulnerability Type: Insecure local credential storage
Risk Level: Medium

Vulnerable Code

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The application stores a Bearer API credential in ~/.upkuajing/.env, but it does not set explicit permissions on either the containing directory or the credential file. The resulting permissions depend on the process umask and any permissions already assigned to ~/.upkuajing.

On a multi-user system with a permissive umask or an existing broadly accessible directory, another local user may be able to read the credential. Opening the file with ordinary write mode also does not verify or repair the permissions of an existing file.

Credential persistence is necessary for the declared authenticated API functionality, but protection of the stored credential is insufficiently enforced.

Attack Path

1. A user runs python scripts/auth.py --new_key.
2. The platform returns a new API key.
3. The script creates or overwrites ~/.upkuajing/.env using permissions derived from the runtime environment.
4. On a system with permissive file permissions, another local account reads the file.
5. The attacker uses the key as a Bearer token against authenticated Upkuajing endpoints.
6. The attacker may inspect account information, initiate paid API requests, consume the account balance, or create recharge-order requests.

Impact Assessment

Exploitation requires local filesystem access under an ac ...[truncated 508 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700 and verify the mode even when the directory already exists.
• Create the credential file atomically with mode 0600, such as by using os.open with O_CREAT, O_WRONLY, and an appropriate replacement strategy.
• Apply chmod(0o600) to an existing credential file before writing, or reject it with a clear error if ownership or permissions are unsafe.
• Verify that the directory and file are owned by the current user and are not symbolic links.
• Avoid truncating the existing credential file until the replacement has been securely written and atomically renamed.
• Prefer an operating-system credential store where available.
• Document credential rotation and revocation procedures in case local disclosure is suspected.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:37

Finding

Setup documentation instructs users to print the complete API credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-43
Vulnerability Type: Accidental secret disclosure through terminal output
Risk Level: Low

Vulnerable Code

markdown

本技能需要API密钥。API密钥存储在 `~/.upkuajing/.env` 文件中：
```bash
cat ~/.upkuajing/.env

文件内容示例：

text

UPKUAJING_API_KEY=your_api_key_here

text

### Technical Analysis

The documented `cat ~/.upkuajing/.env` command prints the entire API key to standard output. Displaying the value is unnecessary when the intended operation is merely to determine whether the required variable is configured.

Terminal output may be retained in session logs, captured by an Agent or automation framework, exposed during screen sharing, copied into support messages, or recorded by shell-session monitoring. Although the code does not itself print the key during ordinary authenticated requests, the setup instructions encourage an avoidable secret-disclosure pattern.

### Attack Path

1. A user or Agent follows the setup instructions.
2. The command prints the complete contents of `~/.upkuajing/.env`.
3. The output is captured in an Agent transcript, terminal recording, support log, screen share, or other observable channel.
4. A party with access to that channel extracts `UPKUAJING_API_KEY`.
5. The exposed key is reused to make authenticated platform requests.

### Impact Assessment

The exposed credential can grant access to the same authenticated API operations available to the legitimate user. Based on the reviewed implementation, this may include paid trade queries, account-information access, recharge-order creation, pricing queries, and diagnostic reporting.

This issue does not grant local system privileges. Its scope is limited to the API account and permissions associated with the disclosed key, but it may result in unauthorized charges, balance depletion, and exposure of account-related information.

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the complete .env file.
• Replace it with a presence-only check that does not reveal the value.
• If configuration status must be shown, print only whether the variable is present and optionally a heavily masked suffix.
• Explicitly instruct users not to paste API keys into chat, issue reports, screenshots, or Agent transcripts.
• Add key rotation and revocation guidance for users who have already exposed a credential.
• Prefer checking the environment variable before accessing the fallback file.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-party HTTP dependency uses an unbounded version range without integrity locking

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Non-reproducible dependency installation
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

The associated installation instruction in SKILL.md is:

bash

pip install -r requirements.txt

Technical Analysis

The requirement specifies only a minimum version and allows any future httpx release to be installed. It also supplies no package hashes. As a result, installations are not reproducible and may resolve to dependency versions that were not present during this audit.

No evidence of typosquatting, dependency confusion, a malicious package name, or an unsafe package source was found. The risk arises from trusting unreviewed future releases and transitive dependency changes without integrity verification.

Attack Path

1. A user follows the documented dependency-installation command.
2. The package resolver selects the newest release satisfying httpx>=0.23.0, along with its then-current transitive dependencies.
3. A future compromised, malicious, or incompatible release is downloaded because no reviewed upper bound, exact pin, or hash prevents it.
4. The dependency code runs when the Skill imports and uses httpx.
5. A compromised dependency would execute with the permissions of the user running the Skill and could potentially access the API credential, request data, response data, and other files accessible to that user.

Impact Assessment

Successful exploitation depends on an upstream package or distribution-channel compromise; no currently malicious dependency was established by this audit.

If such a compromise occurred, dependency code would execute with the Skill process's local user privileges. That scope could include reading UPKUAJING_API_KEY, accessing ~/.upkuajing/.env, intercepting authenticated API traffic before encryption, modifying local files accessible to the ...[truncated 36 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specifically reviewed version rather than using an open-ended lower bound.
• Generate a lock file that includes exact transitive dependency versions.
• Require package hashes during installation, for example through a hash-locked requirements file and pip's hash-checking mode.
• Install dependencies inside an isolated virtual environment.
• Use a trusted package index and disable unapproved supplemental indexes.
• Regularly review and deliberately update pinned versions after vulnerability and compatibility testing.
• Integrate dependency vulnerability scanning into the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local version-cache writes are outside the narrowly advertised date-reference purpose. While not inherently malicious, hidden update/telemetry behavior increases network and file-system reach and can surprise users who expect an offline or minimally invasive utility.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local version-cache writes are outside the narrowly advertised date-reference purpose. While not inherently malicious, hidden update/telemetry behavior increases network and file-system reach and can surprise users who expect an offline or minimally invasive utility.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local version-cache writes are outside the narrowly advertised date-reference purpose. While not inherently malicious, hidden update/telemetry behavior increases network and file-system reach and can surprise users who expect an offline or minimally invasive utility.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local version-cache writes are outside the narrowly advertised date-reference purpose. While not inherently malicious, hidden update/telemetry behavior increases network and file-system reach and can surprise users who expect an offline or minimally invasive utility.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The skill instructs reading ~/.upkuajing/.env directly to access an API key. Directly exposing or handling raw secret files increases the risk of credential disclosure to the model, logs, users, or downstream tools, and is especially dangerous in a skill whose main purpose is unrelated to secret inspection.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill workflow explicitly checks for credentials in a local .env file and supports acquiring and automatically saving new API keys there. This normalizes local secret-file manipulation by the skill, expanding the risk of unauthorized reads/writes, leakage, or persistence of sensitive credentials.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill directs inspection of a local secret file and user-assisted insertion of an API key, which exposes sensitive credential-handling steps inside a general-purpose skill path. In context, this is more dangerous because the same skill also has network and billing-related behaviors, so credential access could enable paid or authenticated remote actions.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script’s functionality is materially unrelated to the declared skill purpose. A skill advertised as date-reference lookup but containing API key issuance, account inspection, and recharge/payment flows expands privileges and user trust boundaries in a deceptive way, increasing the risk of unauthorized billing actions or credential provisioning under false pretenses.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script stores a newly issued API key in a plaintext .env file under the user’s home directory. Plaintext secret storage increases exposure to local compromise, accidental inclusion in backups/repos, and unauthorized reading by other local processes if permissions are weak.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The error path instructs the user to manually set the API key as an environment variable, encouraging secret handling through shells or process environments that may be exposed via logs, shell history, crash reports, or process inspection depending on the platform. In the context of a misleading skill, this also normalizes credential provisioning unrelated to the advertised purpose.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Defining and using a fixed credential file location (~/.upkuajing/.env) establishes a credential access pattern inside a skill that should not need secrets for its declared purpose. In the context of a simple date helper, this is especially suspicious because it normalizes local secret handling and enables later code paths to read and use those credentials for outbound operations.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The load_env_file function reads arbitrary key-value pairs from ~/.upkuajing/.env, giving the skill direct access to locally stored secrets and configuration. In a skill whose stated purpose is date lookup/reference, that capability is unjustified and increases the risk of credential exposure or misuse.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

For a date-reference skill, reading API credentials from the environment or ~/.upkuajing/.env and supporting authenticated external HTTP requests is unnecessary and materially increases risk. Even if this code does not directly exfiltrate secrets, it grants the skill credential access and remote communication primitives that could be abused by adjacent code or future modifications.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The get_api_key function explicitly retrieves an API key from environment variables and then falls back to a local .env file, giving this skill access to authentication material. Because the skill is described as providing date reference values only, this is an unnecessary privilege that could be leveraged for unauthorized API usage or secret exposure.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def get_api_key() -> str:
    """
    获取API密钥，优先从环境变量，其次从 ~/.upkuajing/.env 文件。
    """
    # 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The fallback logic that reads secrets from ~/.upkuajing/.env when the environment variable is absent widens the credential exposure surface and makes secret access more resilient than necessary. In the context of this skill, it further confirms that the code has privileged capabilities unrelated to its declared minimal function.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

# 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

    # 如果环境变量没有，尝试从 ~/.upkuajing/.env 读取
    if not api_key:
        env_vars = load_env_file()
        api_key = env_vars.get(API_KEY_ENV)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code provides a telemetry mechanism that reports agent/skill errors to a platform endpoint and requires fields such as requestId, requestPath, and context. In a simple date-reference skill, this is unnecessary privilege and expands the data-exfiltration surface, particularly because free-form error context can carry secrets, prompts, internal paths, or user content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file performs an outbound error-reporting network call that is unrelated to the declared skill purpose of returning date reference values. Even if framed as observability, this creates undeclared telemetry and a pathway to transmit request metadata or context off-function, which is especially risky because the required 'context' field may contain sensitive operational or user data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This date-reference skill contains a full version-check subsystem that performs outbound network access and local cache writes unrelated to the advertised business function. In a minimal utility skill, hidden update telemetry and persistence expand the attack surface, create undeclared data flows, and could be abused if the API base URL is untrusted or attacker-controlled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code issues an HTTP POST to a remote endpoint to transmit the skill name, despite the skill only needing to compute local date references. Unnecessary outbound connectivity in a simple utility skill is dangerous because it enables covert telemetry, SSRF-like misuse if the base URL is influenced externally, and dependency on remote infrastructure outside user expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares broad capabilities including environment access, file access, and network use, but does not constrain them with an explicit tool scope. That increases the attack surface and makes it harder for a platform or reviewer to enforce least privilege, especially since the skill also handles credentials and paid remote actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad date-related phrases that can cause accidental invocation in unrelated conversations. Because the skill can read credentials and initiate billable or networked actions, overbroad activation materially increases the chance of unintended sensitive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly instructs callers to upload request parameters, response data, and exception context to an error-reporting endpoint. Even though it states sensitive fields are 'automatically masked,' it provides no clear guarantees about what is considered sensitive, no minimization guidance, and no warning to avoid including secrets, personal data, or full stack traces that may contain tokens or business data. In an agent/skill environment, this can lead to unintended exfiltration of operationally sensitive information to a secondary endpoint during failures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and all user-facing help/messages are written exclusively in Chinese, with no indication that other languages are supported or that the user can opt in to this locale. Under the policy, a skill that effectively forces a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.