查询供应商或采购商TopN排名 — 按国家维度和年份返回供应商或采购商的贸易量排名列表，支持游标分页流畅浏览。实现全面的供应商和采购商排名分析，帮助识别关键贸易伙伴并评估市场集中度。帮助采购代理、外贸团队和贸易分析师识别主要贸易对手、评估供应商市场份额和分析采购商集中度，为战略采购和销售规划提供数据支撑，覆盖全球海关贸易数据。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its paid customs-ranking purpose, but it needs Review because it exposes API-key handling too directly and performs an automatic version-check/cache write that is not clearly disclosed.

Review before installing. Use an environment variable or a protected secret store instead of printing or sharing `~/.upkuajing/.env`, rotate the key if it appears in logs, confirm every paid query deliberately, and avoid sending raw request or response data in error reports unless necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API Key Exposure Through Terminal Output and Insecure File Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

=0.23.0 ``` The documented installation command in `SKILL.md:22` is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency specification sets only a minimum version and has no upper bound, exact pin, lock file, or artifact hash. As a result, separate installations of the same audited Skill can resolve to different versions of `httpx`. A future version may introduce incompatible behavior or a security regression affecting TLS, redirects, proxy handling, authentication headers, or request processing. The reviewed source tree therefore does not fully determine the code that will execute at installation and runtime. No evidence was found that `httpx` is currently malicious, that the package name is typosquatted, or that a nonstandard package source is used. The risk is the uncontrolled future dependency resolution rather than a confirmed malicious package. ### Attack Path 1. A user follows the documented setup process and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest available `httpx` release satisfying `>=0.23.0`, rather than a version reviewed with this Skill. 3. If that future release or one of its transitive dependencies is compromised or contains a relevant security regression, its code is installed into the user’s Python environment. 4. The dependency executes when imported by `common.py` and `version_check.py`. 5. Compromised dependency code would run with the same operating-system privileges as the user running the Skill and could potentially access the API key available to the process. ### Impact Assessment The direct confirmed impact is non-reproducible installation and exposure to unreviewed future package behavior. If dependenc ...[truncated 327 chars]

Remediation

View remediation

``` 2. Generate and commit a lock file that also pins all transitive dependencies. 3. Use package hashes during installation, for example through a hash-locked requirements file and: ```bash pip install --require-hashes -r requirements.txt ``` 4. Configure installation to use the official package index or another explicitly trusted internal mirror. 5. Establish a dependency-update process that includes compatibility testing, vulnerability scanning, and deliberate lock-file regeneration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a ranking query tool but appears to perform version-check requests, parse local metadata from SKILL.md, and write a cache file under ~/.upkuajing. This undisclosed update-check and local cache behavior introduces extra network and file-write side effects unrelated to the claimed task, which can surprise users and widen the available execution surface.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill is presented as a ranking query tool but appears to perform version-check requests, parse local metadata from SKILL.md, and write a cache file under ~/.upkuajing. This undisclosed update-check and local cache behavior introduces extra network and file-write side effects unrelated to the claimed task, which can surprise users and widen the available execution surface.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a ranking query tool but appears to perform version-check requests, parse local metadata from SKILL.md, and write a cache file under ~/.upkuajing. This undisclosed update-check and local cache behavior introduces extra network and file-write side effects unrelated to the claimed task, which can surprise users and widen the available execution surface.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a ranking query tool but appears to perform version-check requests, parse local metadata from SKILL.md, and write a cache file under ~/.upkuajing. This undisclosed update-check and local cache behavior introduces extra network and file-write side effects unrelated to the claimed task, which can surprise users and widen the available execution surface.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill instructs reading ~/.upkuajing/.env directly, including a literal cat command against a secrets file. In an agent environment, encouraging direct file reads of credential stores can expose API keys to the model, logs, or unintended outputs, and the context makes this especially dangerous because the skill already combines networked operations with paid actions.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This section directs the workflow to inspect a local .env file for the API key and to persist newly issued keys there automatically. That creates a credential-access and credential-persistence path outside a controlled secret store, increasing the risk of accidental disclosure, improper file permissions, or reuse by unrelated tools.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly tells the user to manually add a provided API key into ~/.upkuajing/.env and notes that a generated key will be auto-saved there. This normalizes local plaintext secret storage and increases the chance of credential theft, leakage through backups/logs, or unintended disclosure to the agent during later file reads.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements API key issuance, account information retrieval, and recharge order creation, which materially exceeds the declared skill purpose of returning Top-N supplier/buyer rankings. This scope mismatch increases the attack surface by bundling credential lifecycle and billing operations into a data-query skill, making it easier for a caller or downstream agent to invoke sensitive capabilities unexpectedly.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The script writes a newly issued API key directly to a .env file in the user's home configuration directory without showing any permission hardening or atomic secure creation. Storing long-lived credentials in plaintext can expose them to other local users, backups, logs, or accidental inclusion in support artifacts, especially in agent environments where files may be broadly accessible.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The error handling and surrounding flow reinforce a design that expects operators to manage the API key as an environment variable or plaintext file, which encourages insecure secret handling. In the context of an agent skill, promoting manual secret placement increases the chance of accidental disclosure through shell history, process environments, screenshots, or shared configuration files.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file header states the code reports agent/skill exceptions to a remote platform, which does not align with the advertised Top-N supplier/buyer ranking functionality. This mismatch is dangerous because hidden or unrelated network behavior in a narrowly scoped skill undermines trust boundaries and can conceal data collection not expected by users or integrators.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file adds a remote error-reporting capability to a skill whose declared purpose is trade ranking, creating a clear scope mismatch and an unexpected outbound data flow. Because the reported payload includes request metadata and free-form context, it can exfiltrate operational or user-derived data to the platform without clear minimization or user awareness.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises only a trade-ranking lookup but declares no explicit tool/permission boundaries while the content clearly expects environment access, local file access, and networked operations. In an agent setting, missing scope declarations increase the chance that the skill is granted broader capabilities than users expect, enabling unintended secret access or side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L003 中的 Trigger 列出“供应商排名、采购商排名、贸易量排名、公司TopN”等短语，但未限定必须与海关/国家贸易概览/年份国家维度相关，容易与一般商业分析或任意排名查询场景重叠。描述中也没有给出不应触发的负例或排除条件，因此触发范围不够具体。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly allows sending request parameters, response data, and exception context to an error-reporting endpoint. Although it notes that sensitive fields are 'automatically masked,' there is no clear requirement for data minimization, explicit user/operator warning, or prohibition on including commercially sensitive or personal data in stack traces and payloads. In a trade/customs skill, these fields can contain company identifiers, transaction details, and operational context, making unintended disclosure to platform-side logging a realistic privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module docstring and user-facing descriptions are entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. Under the policy, forced language selection is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring is written as a Chinese-only description, and the rest of the user-facing strings in the file are also Chinese-only. This indicates a language/locale constraint without any visible opt-in, choice mechanism, or documented region-specific justification, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.