查询供应商或采购商TopN排名 — 按国家维度和年份返回供应商或采购商的贸易量排名列表，支持游标分页流畅浏览。实现全面的供应商和采购商排名分析，帮助识别关键贸易伙伴并评估市场集中度。帮助采购代理、外贸团队和贸易分析师识别主要贸易对手、评估供应商市场份额和分析采购商集中度，为战略采购和销售规划提供数据支撑，覆盖全球海关贸易数据。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.1

Overview

This appears to be a real customs-ranking API client, but it needs review because it also manages paid account actions and stores API keys locally in plaintext.

Install only if you trust the Upkuajing service and are comfortable with paid API calls, account/recharge helper commands, a plaintext API key stored under ~/.upkuajing, and an automatic version check. Confirm every charged query or recharge action, and avoid sending secrets, personal data, or sensitive business payloads in error-report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior includes reading environment variables, accessing local files under ~/.upkuajing/.env, writing credentials, and making network requests. This is dangerous because the runtime trust boundary is unclear: users may invoke a seemingly simple ranking query skill without realizing it can access credentials and persist data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is a trade TopN lookup, but the skill also performs account lifecycle and billing operations such as key enrollment, local credential storage, account info lookup, recharge order creation, pricing queries, error reporting, and version-cache behavior. This mismatch is risky because users may approve a data-query action while unintentionally authorizing broader account, payment, and telemetry operations.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The script implements authentication, account, pricing, and payment-management features that exceed the declared purpose of a Top-N trade ranking skill. This scope mismatch is dangerous because users or host agents may grant trust based on the published ranking-only description while the code can also create accounts, manage API credentials, and initiate recharge flows.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code can create recharge/payment orders even though the skill is presented as a ranking-query tool. In a skill ecosystem, hidden payment-related functionality increases the risk of unauthorized financial actions, social engineering, or user confusion about what operations may be triggered.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script provisions a new API key and stores it locally, which is materially more sensitive than the declared query-only capability. This expands the blast radius by enabling credential issuance and persistence that could be abused to gain ongoing API access outside the user’s expectation of a read-oriented ranking skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script exposes account information, balances, and pricing-management related functionality outside the advertised trade-ranking scope. Even if these are legitimate platform operations, bundling them into an unrelated skill can leak financial/account metadata and violate least-privilege expectations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module adds outbound network access and local persistent cache writes for self-update/version telemetry that are unrelated to the stated trade-ranking function of the skill. Even if intended for legitimate maintenance, this expands the skill's attack surface, can leak metadata such as skill usage/check timing, and creates a hidden side effect users may not expect from a business-query capability.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code performs external version probing via HTTP and persists results under the user's home directory, which exceeds the minimum privileges needed for a customs ranking query skill. In a hostile or compromised environment, this mechanism could be repurposed for unwanted beaconing, environmental fingerprinting, or persistence of state outside the core skill workflow.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The API documentation instructs callers to submit request parameters, response payloads, and error context for troubleshooting, but it does not clearly require client-side minimization or warn operators not to include secrets, credentials, personal data, or commercially sensitive records. Although the text says sensitive fields will be automatically masked, relying on server-side masking after transmission still exposes sensitive data in transit, logs, and upstream handling if callers send raw content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function forwards a caller-provided 'context' field and request metadata to a remote endpoint without any indication of redaction, classification, or user/operator warning. In practice, exception context often contains stack traces, request fragments, identifiers, or business data, so this can lead to unintended disclosure of sensitive information to the platform backend.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs reading and potentially writing API keys in ~/.upkuajing/.env, including saving newly issued keys automatically. This is sensitive credential handling: local plaintext storage and agent-mediated file access increase the risk of credential exposure, misuse, or unauthorized persistence beyond the user's intent.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the credential-access workflow by directing the agent to inspect ~/.upkuajing/.env and handle user-provided or newly created API keys. In the context of a trade-ranking skill, such credential-management behavior is more dangerous because it expands the attack surface from data retrieval into secret collection and persistence.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 90% confidence
• Finding: The function explicitly manages API credentials via a .env file path, indicating local secret handling in a broadly scoped skill. In this context, storing and managing credentials in plain-text configuration files increases the risk of secret disclosure through filesystem access, backups, logs, or accidental sharing.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 88% confidence
• Finding: Reading the existing .env file to inspect whether an API key exists introduces direct access to local secret material. While the immediate logic is simple, any unnecessary secret-file reads widen exposure and normalize credential handling in an unrelated skill context.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 97% confidence
• Finding: The code writes the newly issued API key directly into a .env file, creating persistent plaintext storage of a credential. This is dangerous because compromise of the local environment, workspace sync, or accidental file disclosure can provide long-lived access to the external API.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.23.0), which allows future major or minor versions to be installed without review. This can introduce breaking changes or known-vulnerable releases through transitive resolution, reducing build reproducibility and increasing supply-chain risk.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196