查询日期参考信息 — 获取去年年份、上月月份、去年当月等日期参考值，用于海关贸易数据查询。提供准确的财务参考日期，支持海关数据分析和进出口贸易研究。帮助外贸团队、贸易分析师和进出口从业者获取精确的日期参数用于海关贸易查询、市场趋势分析和贸易情报研究，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:42 AM UTC
• Version: 1.0.1

Overview

This is a disclosed paid API helper for trade-date reference data, but users should notice it stores an API key locally, contacts the provider, and can create recharge/order and error-report requests with confirmation.

Install only if you are comfortable using Upkuajing's paid API from this agent. Confirm charges before running queries, protect the UPKUAJING_API_KEY stored under ~/.upkuajing/.env, review any recharge/payment URL before paying, and avoid including sensitive business data in optional error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares itself as a simple date-reference lookup, but the content instructs the agent to access environment variables, read local files, write secrets to ~/.upkuajing/.env, and contact remote services. Undeclared capabilities increase the chance of users or orchestrators invoking the skill without understanding its true authority, which can lead to unintended credential handling and network actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is limited to returning date reference values, but the skill also covers API key enrollment/storage, account inspection, recharge/payment flows, pricing queries, error reporting, and version/network interactions. This mismatch is dangerous because it hides materially different and more sensitive behaviors behind an innocuous description, increasing the risk of deceptive invocation and overbroad trust.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key issuance, account lookup, recharge order creation, and pricing queries, which are materially unrelated to a skill advertised as date-reference lookup. That mismatch is dangerous because a user or hosting agent may invoke a seemingly harmless skill that actually performs account-affecting operations and handles credentials, expanding the attack surface and enabling deceptive privilege use.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code exposes capabilities for credential provisioning, account inspection, and recharge order generation in a context that only needs date calculations. In a low-risk date-query skill, such hidden financial/authentication functions are especially risky because users and orchestration systems are less likely to expect or scrutinize them.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This shared utility implements generic remote API invocation, authentication handling, and response processing for a skill whose declared purpose is only to return simple date reference values. That creates a clear capability/context mismatch: a seemingly harmless date skill can trigger authenticated outbound requests to an external service, expanding the attack surface and enabling unnecessary data access or misuse under the user's credentials.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code retrieves an API key from environment variables or a local .env file and uses it for authenticated requests, despite the skill's stated date-reference purpose not requiring any secret or remote service. In this context, credential access is unjustified and dangerous because it allows a low-risk appearing skill to leverage stored secrets for external communication.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code creates per-task directories and persists metadata and results to local files, which is unnecessary for a simple date reference skill. Unneeded persistence increases the risk of data retention, local information disclosure, and misuse of the skill as a covert storage mechanism, especially when paired with remote API functionality.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements exception reporting to a remote platform, which is materially different from the declared skill purpose of returning date reference values for trade queries. This capability mismatch is dangerous because it can enable unexpected collection and transmission of request metadata or context, violating least surprise and increasing data exfiltration risk in a skill that users would not expect to perform network reporting.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code sends exception data, including request identifiers, paths, and free-form context, to an external endpoint via make_request('/agent/skill/error/report', params). In a date-reference skill, that behavior is not proportionate to the advertised function and could leak sensitive operational or user-derived data to a platform service without clear necessity or scope control.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file adds update-checking, network access, and persistent local caching to a skill whose declared purpose is only date-reference lookup. That mismatch is security-relevant because it expands the skill's capabilities beyond user expectations, enables outbound communication, and stores state in the user's home directory without any evident necessity for the core function.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code performs an external HTTP POST to a server endpoint and transmits the skill name, even though the skill is described as a local date-reference utility. In this context, undisclosed network capability is dangerous because it creates data exfiltration and tracking potential, increases attack surface, and violates least-privilege expectations for a simple offline skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module creates and reads/writes a cache file under the user's home directory for version-check state, which is unrelated to the skill's stated date-query purpose. While not directly code-executing, this persistent storage can be used for tracking, leaves unnecessary artifacts on disk, and broadens the skill's behavioral footprint beyond what users would reasonably expect.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Broad trigger phrases such as generic date-related wording can cause accidental activation in ordinary conversation. In this skill, unintended activation is more concerning because any invocation can lead into fee-based API usage, credential prompts, or ancillary remote actions, not just harmless local formatting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs agents to report `requestParams`, `responseData`, and detailed `context` to an error-reporting API, which can easily include personal data, credentials, trade data, or other sensitive content from failed requests. Although it says sensitive fields will be auto-masked, it does not define what is masked, require minimization, or give a user-facing warning/consent model, so operators may over-share sensitive data into centralized logging systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The network submission of error details may transmit requestPath, requestId, and context without any visible user-facing notice, consent, or sanitization shown in this file. If context contains stack traces, business data, or user inputs, the reporting path can become a privacy and data-handling issue even if intended for troubleshooting.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The version-check request sends the skill name to an external service without any clear in-file disclosure, prompt, or consent mechanism. Even if the transmitted data is limited, this still creates an avoidable privacy and transparency issue because a simple date utility is unexpectedly contacting a remote service.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

获取API密钥，优先从环境变量，其次从 ~/.upkuajing/.env 文件。
    """
    # 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

    # 如果环境变量没有，尝试从 ~/.upkuajing/.env 读取
    if not api_key:

• Confidence: 96% confidence
• Finding: Reading secrets from process environment variables is not inherently malicious, but in this skill it constitutes unjustified credential harvesting because the advertised functionality does not need secrets at all. In context, this enables a benign-looking date utility to obtain sensitive authentication material that can be used for external requests.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill explicitly instructs checking for an API key in ~/.upkuajing/.env and managing credential presence there. Directing an agent skill to inspect local secret stores creates credential-access behavior beyond the stated date-query purpose and risks exposing, mishandling, or normalizing access to sensitive tokens.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: The skill further instructs writing user-provided or newly issued API keys into ~/.upkuajing/.env. Persisting secrets to a local file from within a routine date-query skill increases the blast radius of compromise, can leave credentials in plaintext on disk, and couples a low-risk workflow to sensitive credential storage operations.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key in plaintext to a .env file under the user's home directory without any visible permission hardening or secure storage controls. If the host environment has weak filesystem permissions, backups, multi-user access, or later logging of that file, the credential can be exposed and used to access the associated account or APIs.

Credential Access

High

• Category: Privilege Escalation

Content

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

• Confidence: 91% confidence
• Finding: Defining a fixed path to a user-scoped .env credential store signals that this code is designed to access locally stored secrets. For a date-reference skill, this is an unnecessary privileged capability and materially increases risk because it normalizes secret access in a context where users would not expect it.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

• Confidence: 95% confidence
• Finding: The function explicitly loads environment variables from a local .env file, which is direct access to potentially sensitive credentials. Given the skill context, this is a disproportionate and concealed capability that could expose or misuse secrets under the guise of a harmless utility.

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key() -> str:
    """
    获取API密钥，优先从环境变量，其次从 ~/.upkuajing/.env 文件。
    """
    # 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

• Confidence: 95% confidence
• Finding: This function is dedicated to obtaining an API key from the environment or local credential file, which confirms that the skill accesses secrets despite not needing them for its declared purpose. The mismatch makes the capability more dangerous because users and reviewers may underestimate the risk profile of the skill.

Credential Access

High

• Category: Privilege Escalation

Content

# 优先从环境变量获取
    api_key = os.environ.get(API_KEY_ENV)

    # 如果环境变量没有，尝试从 ~/.upkuajing/.env 读取
    if not api_key:
        env_vars = load_env_file()
        api_key = env_vars.get(API_KEY_ENV)

• Confidence: 96% confidence
• Finding: The fallback from environment variables to a local .env file broadens the ways this skill can obtain credentials, increasing the likelihood it will successfully access secrets on a user's machine. In a simple date skill, this is especially concerning because the broader credential access is unnecessary and unexpected.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 88% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including future releases with breaking changes or potentially compromised transitive behavior. This weakens build reproducibility and supply-chain control, making it harder to ensure the skill is tested against the exact package version that will run.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196