Query national trade overview summary data — retrieve annual trade totals, quarterly trade volumes, and supplier/buyer counts by country pair for comprehensive trade analysis. Delivers macro-level trade intelligence with aggregated statistics across time periods. Designed for export teams, trade analysts and market researchers who need summarized country-level trade data, trade volume snapshots and partner ecosystem evaluation for strategic decision-making across 220+ countries and territories.

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:11 AM UTC
• Version: 1.0.0

Overview

The skill can query trade summaries, but it also manages API keys, account balance, pricing, and top-up orders while storing credentials in a local plaintext file.

Install only if you trust UpKuaJing with your trade queries and account workflow. Expect the skill to contact UpKuaJing, incur fees after confirmation, read or create ~/.upkuajing/.env, store an API key there, and assist with top-up orders. Review local file permissions and avoid enabling API logging unless you are comfortable storing request and response data locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares only environment requirements in metadata, but its documented behavior includes reading local files, writing to ~/.upkuajing/.env, and making network calls. This capability mismatch weakens user consent and platform enforcement because the skill can access credentials and modify local state without those powers being transparently declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a trade-summary query tool, but the documented workflow also includes account enrollment, credential storage, balance checks, recharge order creation, pricing queries, and local cache writes. This broadens the trust boundary significantly beyond simple data retrieval and can lead users to authorize sensitive account and payment-related actions they did not expect.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements authentication, credential issuance, account lookup, pricing lookup, and recharge-order creation, which materially exceeds the stated skill purpose of retrieving trade overview summaries. In an agent-skill context, this scope mismatch is dangerous because it grants the skill the ability to create and manage paid access and local credentials, increasing the risk of unauthorized account manipulation or secret handling unrelated to the user’s expected task.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The account-info, pricing, and recharge-order capabilities are unrelated to a trade overview summary skill and expose financial/account-management actions through the same surface. That mismatch makes abuse more plausible because users invoking a data-query skill would not reasonably expect billing or payment workflows to occur.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can create a new API key and persist it locally, which is a credential-management capability not justified by the advertised trade-summary function. In a skill ecosystem, hidden or unexpected secret creation/storage increases the chance of unauthorized credential issuance, persistence, and later misuse.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This module performs outbound network communication and persists data under the user's home directory, behavior that is unrelated to the advertised trade-summary function of the skill. Hidden side effects expand the trust boundary, create unnecessary data flow to a remote service, and establish local persistence that users may not expect from a read-oriented data skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill contains self-audit/update-check functionality that is not justified by its stated purpose of querying trade overview statistics. While not directly executing updates, this kind of auxiliary control-plane behavior is risky in a skill because it introduces covert communications and can be a stepping stone for future unwanted update or telemetry mechanisms.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key directly into a local .env file without an explicit warning, confirmation, or permission-hardening step. This is dangerous because users may unknowingly persist a sensitive credential on disk where it could be exposed through weak filesystem permissions, backups, or other tooling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The request/response logging functions write full request parameters and full API responses to local log files when enabled, without redaction or user-facing consent at the write site. If parameters or responses contain sensitive trade data or credentials, they could be exposed to other local users, backups, or forensic tooling.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The version check transmits the skill name to a remote API without clear user-facing disclosure. Although the payload is small and not highly sensitive on its face, undisclosed outbound requests are a privacy and transparency issue, especially in a skill whose documented purpose does not require contacting an update service.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The code creates and writes a version cache in the user's home directory without explicit disclosure or consent. This is low-severity but still a real issue because it introduces persistent side effects outside the skill's core function and may surprise users or violate least-surprise expectations in restricted environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 92% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 91% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 92% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 97% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: httpx>=0.23.0

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: auth=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: require_auth=False

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58