ClawHub
Back to skill

Security audit

查询供应商或采购商TopN排名 — 按国家维度和年份返回供应商或采购商的贸易量排名列表，支持游标分页流畅浏览。实现全面的供应商和采购商排名分析，帮助识别关键贸易伙伴并评估市场集中度。帮助采购代理、外贸团队和贸易分析师识别主要贸易对手、评估供应商市场份额和分析采购商集中度，为战略采购和销售规划提供数据支撑，覆盖全球海关贸易数据。

Security checks across malware telemetry and agentic risk

Overview

The skill can perform the advertised trade-ranking query, but it also handles local API keys and account recharge/payment-order flows that users should review before installing.

Install only if you are comfortable with a paid Upkuajing integration that stores an API key in a local plaintext file, checks account/balance and pricing information, and can create recharge payment-order links. Confirm costs before running queries or recharge actions, restrict access to ~/.upkuajing/.env, and consider setting the API key through a safer secret mechanism instead of using the auto-save flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions, yet its documented behavior clearly requires network access, reading local credential files, and writing API keys to ~/.upkuajing/.env. This creates a transparency and sandboxing problem: users and hosts cannot accurately assess or constrain what the skill can do before execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims to perform trade-ranking queries, but also includes credential provisioning, account inspection, pricing lookup, and recharge/payment-order creation. Expanding from data retrieval into account and billing operations increases the attack surface and can lead to unexpected sensitive actions or paid transactions beyond the user's intended request.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file implements API key issuance, account information lookup, recharge order creation, and pricing queries, which materially exceed the declared purpose of a skill that should only return Top-N supplier/buyer trade rankings. This kind of scope expansion increases the attack surface and gives the skill access to account and billing operations that are unnecessary for its stated function, making abuse or user surprise more likely.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Creating recharge orders is a financial/account operation unrelated to querying supplier or buyer rankings. In the context of this skill, exposing payment initiation creates unnecessary risk of unauthorized charges, social engineering, or confusing users into triggering billing flows they did not expect.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The code exposes account balances and platform pricing information, which are not required for a Top-N trade ranking skill. While less severe than payment creation, this still broadens data exposure and may leak sensitive business/account metadata to contexts that only need trade-query capabilities.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This module performs outbound HTTP requests to a remote API and writes persistent state under the user's home directory, even though the skill's stated purpose is trade ranking queries. That creates unnecessary data flow and side effects: it can disclose skill usage metadata, introduce dependency on an external service, and expand the attack surface if the endpoint or local cache is abused or tampered with.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code implements self-update/version telemetry logic unrelated to the business function of returning Top-N trade rankings. Even if intended for maintenance, hidden telemetry/update checks are risky because they create covert network behavior and can be leveraged for tracking, endpoint manipulation, or social engineering via upgrade prompts.

Credential Access

High
Category
Privilege Escalation
Content
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；
Confidence
93% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**
Confidence
93% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
88% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }
Confidence
90% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
94% confidence
Finding
httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196