查询国家贸易概览汇总数据 — 获取年度贸易总量、季度贸易量、供应商/采购商数量等国家维度的汇总信息。提供宏观层面的贸易情报，包含按时间段汇总的统计数据。帮助外贸团队、贸易分析师和市场研究人员获取汇总的国家级贸易数据、贸易量概览和伙伴生态系统评估，为战略决策提供数据支撑，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:01 AM UTC
• Version: 1.0.1

Overview

The artifacts fit a paid trade-data lookup skill, with disclosed API-key, billing, and support helpers that need deliberate user approval.

Install only if you intend to use the Upkuajing paid API. Keep UPKUAJING_API_KEY private, avoid printing ~/.upkuajing/.env, confirm each paid query or recharge flow in a separate message, and review any error-report context before sending it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares only basic metadata but instructs the agent to use environment variables, read/write local files under ~/.upkuajing/.env, and make networked API calls. Undeclared capabilities reduce transparency and user consent, making it easier for a skill to access secrets or modify local state unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a trade-summary lookup skill, but the instructions also cover credential provisioning, account inspection, billing flows, payment-order creation, error reporting, and version-check/cache behavior. This mismatch increases the chance that users or orchestrators invoke a seemingly read-only data skill that can also access secrets, initiate charge-related actions, and modify local files.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication, account lookup, pricing, and recharge-order functionality even though the declared skill is only for country trade overview summaries. This creates unnecessary capability expansion and increases the attack surface, including financial and credential-related operations that users would not reasonably expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The ability to create recharge/payment orders is unrelated to the stated purpose of querying trade overview data. In a skill context, hidden or unexpected payment capabilities are dangerous because they enable financially impactful actions under the guise of a read-only data tool.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script can request a new API key and persist it locally, which exceeds the expected scope of a trade-summary query skill. This is dangerous because it grants credential lifecycle capabilities to a skill that should likely be data-read-only, enabling account provisioning and local secret storage without clear separation of duties.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Account balance and pricing queries are out of scope for a skill advertised as providing national trade overview statistics. While less severe than payment creation, these capabilities expose financial/account metadata and indicate privilege creep that makes the skill more dangerous than its description suggests.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This module introduces outbound network access to a remote API and writes persistent state under the user's home directory, even though the skill's stated purpose is only to provide trade-summary data. That expands the skill's capability surface beyond its declared function, creating privacy, telemetry, and supply-chain risk if the endpoint is untrusted, compromised, or later repurposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs callers to include raw request parameters and response data in an error-reporting API, while only noting that sensitive fields will be 'automatically masked' without defining scope, guarantees, or user consent requirements. This creates a realistic risk of transmitting operationally sensitive or personal data to the platform during troubleshooting, especially because error contexts often contain tokens, identifiers, payloads, and business data that are broader than what automated masking reliably catches.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The code includes request/response logging that can persist transmitted API parameters and response bodies to local files under ~/.upkuajing/logs. Although logging is disabled by default, if enabled it may capture sensitive business data or API responses without redaction, creating a local data exposure risk through filesystem access, backups, or support bundle collection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code forwards request metadata and free-form context to `/agent/skill/error/report` without any visible data minimization, redaction, or user-facing disclosure. If `context`, `requestPath`, or related fields contain sensitive user data, prompts, identifiers, or secrets, this can cause unintended exfiltration to the platform and broaden exposure during logging and support workflows.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill explicitly instructs checking a credential file and storing API keys in ~/.upkuajing/.env, which involves credential discovery and local secret handling. In an agent context, this is dangerous because a skill nominally meant for data lookup is also guiding secret access and persistence, increasing the risk of credential exposure, misuse, or unauthorized file writes.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: This section continues the credential-handling flow by directing users to add keys to ~/.upkuajing/.env or generate new ones automatically, which couples the skill to sensitive credential storage and modification. Because the surrounding skill is presented as a trade-query tool, the secret-management behavior is more dangerous due to lower user expectation and increased likelihood of overbroad trust.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: Writing a newly created API key directly into a plaintext .env file creates a real secret-handling weakness. If local file permissions are weak, backups are exposed, or other software reads the file, the key can be stolen and used to access the associated account or API services.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound only constraint (httpx>=0.23.0), which allows future unreviewed major or minor releases to be installed. This creates supply-chain and stability risk because a later release could introduce a vulnerable or incompatible version without the skill author explicitly approving it.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196