Query national trade overview summary data — retrieve annual trade totals, quarterly trade volumes, and supplier/buyer counts by country pair for comprehensive trade analysis. Delivers macro-level trade intelligence with aggregated statistics across time periods. Designed for export teams, trade analysts and market researchers who need summarized country-level trade data, trade volume snapshots and partner ecosystem evaluation for strategic decision-making across 220+ countries and territories.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:58 AM UTC
• Version: 1.0.1

Overview

This skill mainly performs paid trade-summary API queries, but it also includes broader account, billing, credential storage, error-reporting, and undisclosed version-check behavior that users should review first.

Review this skill before installing if you are comfortable with a paid third-party API integration that can store an API key in a plaintext dotfile, create top-up payment links after user direction, report diagnostic data after confirmation, and perform an undisclosed daily version check to the provider. Avoid sending sensitive request or response details in error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while its documented behavior requires environment access, reading and writing files under the user's home directory, and network/API communication. This under-declaration reduces transparency and informed consent, making it easier for a user or platform to invoke a skill with broader capabilities than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is a trade-summary query skill, but the documented behavior also includes credential provisioning, local secret storage, account and balance access, billing/top-up flows, error reporting, and version-cache writes. This mismatch expands the trust boundary well beyond a simple data query and increases the chance of unexpected sensitive actions being taken under a misleading description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key issuance, account inspection, pricing lookup, and recharge-order creation, which are materially broader than a skill advertised as a read-only trade overview summary tool. In a skill ecosystem, purpose-misaligned capabilities increase the attack surface, enable unexpected credential handling and billing actions, and can mislead users into authorizing behavior they did not intend.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Creating recharge/payment orders is not justified by a read-oriented trade-summary skill and introduces a direct financial-action capability. If exposed through the skill interface, it could trigger unwanted billing flows or be abused for deceptive monetization, especially because users would not expect payment actions from this skill context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill exposes API key application and local credential storage as user-facing functionality even though its stated purpose is data retrieval. This is dangerous because it normalizes credential provisioning and secret persistence in a context where users expect simple query behavior, increasing the chance of accidental secret handling and broader privilege exposure.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module performs outbound network communication and persists state to the user's home directory even though the skill's declared purpose is only to retrieve trade overview summaries. That mismatch expands the skill's privilege and data-handling surface, creating an unnecessary telemetry/update channel that could leak usage metadata or be abused if the configured API base URL is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes self-update/version telemetry behavior unrelated to its stated business function. Even though it only sends the skill name, hidden background calls violate least privilege and create an unnecessary external dependency and metadata disclosure path.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module writes a persistent cache file under the user's home directory for functionality unrelated to trade data retrieval. Unnecessary persistent state increases privacy and tampering risk, especially if other local processes can inspect or modify the cache to influence skill behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly instructs agents to transmit request parameters, response payloads, and exception context to a remote error-reporting API. Even though it says sensitive fields will be auto-masked, this is not a sufficient security guarantee: stack traces, request bodies, and response content commonly contain personal data, secrets, business-sensitive trade data, or tokens that may not be fully redacted. In an agent skill context, silent telemetry export increases privacy and data-leakage risk because failures often occur on real user inputs and backend responses.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends a caller-supplied `context` field and request metadata to a remote `/agent/skill/error/report` endpoint without any sanitization, minimization, or disclosure mechanism. In this skill context, error payloads may include trade queries, identifiers, or other sensitive runtime data, creating a realistic risk of unintended data exfiltration through telemetry.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The version check transmits the skill name to a remote service without any user-facing notice or consent. While the data appears limited, silent metadata transmission can reveal installed capabilities and usage patterns and is inappropriate for a skill whose purpose does not require such disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs reading `~/.upkuajing/.env` and storing API keys there, which is credential access and local secret handling beyond the core query function. If abused or combined with other capabilities, this can expose, overwrite, or misuse API credentials and facilitate unauthorized account actions.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: This section continues the credential-handling flow by checking for an API key, asking the user to provide one, or automatically applying for and saving a new key into `~/.upkuajing/.env`. That creates a sensitive path for credential acquisition and persistence, which is risky in a skill that is presented primarily as a data-query tool.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 90% confidence
• Finding: The code explicitly works with a .env file for API key handling, indicating local credential discovery and persistence. Storing or managing secrets in plain text within a user-accessible file increases the risk of accidental disclosure, backup leakage, mispermissioning, or unintended reuse by other tools on the host.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 91% confidence
• Finding: Reading an existing .env file to inspect whether an API key is present is credential-access behavior that expands the skill's ability to interact with local secrets. In this skill context, such local secret handling is unexpected and increases the risk of exposing sensitive configuration data or normalizing overly broad file access.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: Writing the API key directly into a .env file persists sensitive credentials in plaintext on disk. This can be exploited through local compromise, weak file permissions, shared home directories, shell tooling, backups, or accidental check-in, turning a query skill into a secret-handling risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only constraint (httpx>=0.23.0), which allows installation of any newer version, including unreviewed major releases with breaking changes or newly introduced security issues. This weakens build reproducibility and can cause the skill to pull different dependency trees over time, increasing supply-chain risk.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58