ClawHub
Back to skill

Security audit

查询国家贸易概览汇总数据 — 获取年度贸易总量、季度贸易量、供应商/采购商数量等国家维度的汇总信息。提供宏观层面的贸易情报，包含按时间段汇总的统计数据。帮助外贸团队、贸易分析师和市场研究人员获取汇总的国家级贸易数据、贸易量概览和伙伴生态系统评估，为战略决策提供数据支撑，覆盖全球 220 多个国家和地区。

Security checks across malware telemetry and agentic risk

Overview

This is a coherent paid trade-data API skill, but it needs review because it reads and stores API keys locally and includes account, billing, and under-disclosed version-check behavior.

Install only if you are comfortable giving this skill access to a paid Upkuajing API account. Protect ~/.upkuajing/.env, review its permissions after key creation, and treat account info, recharge orders, and any fee-incurring query as actions that should require your explicit approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions, yet its documentation clearly instructs access to environment variables, local files under ~/.upkuajing/.env, and external network/API operations. This creates a transparency and consent problem: a user or orchestrator may authorize a seemingly low-privilege trade-summary skill that can also read local secrets and initiate billed network actions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The stated purpose is a read-oriented trade overview query, but the documented behavior expands into account lifecycle and billing actions: creating API keys, writing them to disk, querying account status, creating recharge orders, and hitting additional service endpoints. This mismatch is dangerous because users may invoke the skill expecting passive data retrieval while it can perform side-effecting account and payment-related operations.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The code posts the skill name to a remote version-check API without any user-facing notice, consent, or configuration visible in this file. While the data sent is limited, it still creates an outbound telemetry channel that may reveal installed skill usage or environment details, especially if the API base URL is externally controlled.

Credential Access

High
Category
Privilege Escalation
Content
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
91% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
90% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
86% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }
Confidence
74% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
95% confidence
Finding
httpx>=0.23.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196