ClawHub
Back to skill

Security audit

查询国家贸易概览汇总数据 — 获取年度贸易总量、季度贸易量、供应商/采购商数量等国家维度的汇总信息。提供宏观层面的贸易情报，包含按时间段汇总的统计数据。帮助外贸团队、贸易分析师和市场研究人员获取汇总的国家级贸易数据、贸易量概览和伙伴生态系统评估，为战略决策提供数据支撑，覆盖全球 220 多个国家和地区。

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised trade-summary query, but its API-key handling, recharge/payment-order flow, and automatic update/reporting helpers create sensitive account and credential risk that users should review before installing.

Review this before installing if you will use a paid Upkuajing account. Do not print or paste the full API key into chat, logs, screenshots, or support tickets; prefer an environment variable or a securely permissioned credential file. Treat recharge order creation, account-info lookup, pricing lookup, exception reporting, and every billable query as actions that need explicit confirmation, and minimize any request or response data sent in error reports.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:63
Finding

API key is stored without explicitly restrictive filesystem permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

Setup instructions disclose the complete credential through terminal output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Dependency installation is not reproducible because httpx has no upper or exact version bound

Content
View full analysis
=0.23.0 ``` The documented installation operation is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement accepts any `httpx` version at or above `0.23.0`, together with whatever transitive dependency versions the resolver selects at installation time. Consequently, installations performed at different times may execute materially different dependency code without a corresponding Skill review. No typosquatted package, malicious package, or untrusted package index was identified. The risk arises from the absence of an exact reviewed version, transitive lock file, and integrity hashes. A future compromised, incompatible, or unexpectedly changed release could therefore enter the environment automatically. ### Attack Path 1. The Skill is installed or its dependencies are refreshed. 2. `pip` resolves the newest version satisfying `httpx>=0.23.0`. 3. A future compromised or incompatible release, or a compromised transitive dependency, satisfies the requirement. 4. Package installation or subsequent import executes the unreviewed code with the installing user's privileges. 5. The dependency could access the same environment, files, network, and API credential available to the Skill process. This path is contingent on a future supply-chain compromise or unsafe release; the audited dependency name itself is not known to be malicious. ### Impact Assessment Dependency code runs with the privileges of the Python process. In a successful supply-chain compromise, it could read the API key, access user files available to that process, alter API requests, or make arbitrary network connections. The practical current risk is low because no malicious dependency was confirmed. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (39)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose is limited to trade overview queries, but the finding indicates additional version-check logic involving local file writes, metadata parsing, and remote update checks. Even if benign, these undeclared behaviors widen the attack surface and create unexpected outbound communication and local state changes not implied by the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose is limited to trade overview queries, but the finding indicates additional version-check logic involving local file writes, metadata parsing, and remote update checks. Even if benign, these undeclared behaviors widen the attack surface and create unexpected outbound communication and local state changes not implied by the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose is limited to trade overview queries, but the finding indicates additional version-check logic involving local file writes, metadata parsing, and remote update checks. Even if benign, these undeclared behaviors widen the attack surface and create unexpected outbound communication and local state changes not implied by the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill instructs reading a plaintext credential file from the user’s home directory using a shell command. Accessing and potentially exposing secrets from ~/.upkuajing/.env is sensitive credential handling and can leak API keys through logs, chat output, or unintended tool execution.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill directs the agent to inspect for an API key and, if absent, to have the user provide one for manual placement into a local .env file or generate one that is auto-saved there. This normalizes insecure secret collection and persistence, increasing the risk of credential leakage, theft, and reuse across sessions or other tools on the host.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

This line continues the insecure credential-management workflow by directing checks of a local secret file and persistence of newly issued keys into that file. In the context of a skill marketed as a trade-query tool, this is more dangerous because users may not expect secret-file access or credential storage side effects from a seemingly simple data lookup capability.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file implements account management, API key issuance, billing/recharge, and pricing operations that are unrelated to a skill advertised as providing country-level trade overview summaries. Such hidden or extraneous capabilities expand the attack surface and create an unexpected trust boundary, especially because they can modify account state and provision credentials.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

Writing a newly issued API key into a plaintext .env file creates a credential exposure risk if file permissions are weak, the home directory is shared, backups are accessible, or other local processes can read the file. In the context of a skill that does not need to manage credentials, this makes the behavior more concerning because it silently persists sensitive secrets outside the expected skill scope.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The ability to create recharge/payment orders is a financial side-effect that is not justified by a trade-summary skill. If invoked unexpectedly, it could trigger unauthorized billing flows, confuse users, or be abused to redirect users into payment actions under false pretenses.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a read-oriented trade overview summary skill that returns annual/quarterly trade totals and supplier/buyer counts. In contrast, this code gathers execution-context fields and sends them to an '/agent/skill/error/report' API, which is operational telemetry/reporting behavior rather than trade-summary retrieval.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope or permission boundaries while its documented behavior includes environment access, local file reads/writes, and network/API operations. That combination creates an over-privileged skill surface where a caller may invoke sensitive capabilities that are not transparently constrained or auditable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

文件名和描述中的“zh”以及全文仅以中文提供操作说明，体现出该技能面向固定语言环境，但文档中没有说明这是用户可选项，也没有提供语言切换或显式 opt-in。按照语言/地区策略，强制特定语言而无选择机制属于自然语言策略风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

该描述在 Trigger 中列出“贸易概览汇总”“年度贸易统计”“国家贸易总量”“贸易量概览”等短语，其中部分表达较泛，且没有说明触发上下文、适用范围或负面示例。对于 markdown/manifest 类文件，这种缺少约束的触发说明可能与一般贸易分析请求重叠，增加非预期调用风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document instructs agents to report exceptions to a remote API and explicitly allows inclusion of request parameters, response data, and error context, which can contain sensitive operational or user data. Although it notes that sensitive fields are 'automatically desensitized,' it does not define guarantees, scope, or required minimization, so users may over-share confidential data off-box without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all user-facing CLI descriptions/messages are written only in Chinese, which constitutes a language-specific user experience with no opt-in or alternative locale. The stated policy requires flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code provisions new API keys and stores them locally, which is outside the declared trade-summary functionality. Credential issuance inside an unrelated skill increases the risk of unauthorized account setup, credential sprawl, and misuse if the local environment or surrounding tooling is compromised.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0: