Query top N suppliers or buyers by trade volume — retrieve ranked lists of suppliers or buyers for a given country pair and year, with cursor-based pagination for seamless browsing. Enables comprehensive supplier and buyer ranking analysis to identify key trade partners and assess market concentration. Designed for sourcing agents, export teams and trade analysts who need to identify top trading counterparts, evaluate supplier market share and analyze buyer concentration for strategic procurement and sales planning across global customs data.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:59 AM UTC
• Version: 1.0.1

Overview

This is a coherent paid UpKuaJing trade-ranking skill, but it stores an API key locally and contacts UpKuaJing for queries, account support, optional error reports, and version checks.

Install only if you are comfortable using UpKuaJing's paid API, storing the API key in ~/.upkuajing/.env, and having the skill contact UpKuaJing for queries, account support, pricing, optional error reports, and version checks. Confirm fees and top-ups carefully, and do not include confidential business details in error-report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit permissions while instructing use of environment variables, reading and writing files under ~/.upkuajing/.env, and making networked API calls. This under-declaration weakens user awareness and policy enforcement, increasing the chance that credential, filesystem, and network actions occur without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a simple top-N trade ranking query tool, but it also includes account creation, balance inspection, payment/top-up order creation, error reporting to the platform, and local metadata caching/version checks. This broader behavior materially expands the trust boundary and can lead users to authorize credential handling, billing-related actions, and outbound reporting they did not expect from the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key issuance, account inspection, recharge order creation, and pricing lookup, which are materially unrelated to a skill whose declared purpose is querying top-N suppliers/buyers by trade volume. Expanding a data-query skill into credential and billing management increases attack surface and enables sensitive or financially impactful operations a user would not reasonably expect in this context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script can create recharge/payment orders via /agent/auth/pay/url, which introduces a billing capability unrelated to top-N trade ranking. In the context of an analytics skill, hidden payment flows are especially risky because they can trigger unauthorized charges or social-engineer users into completing payments they did not expect.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code can request a new API key and persist it locally, despite the skill being presented as a read-oriented trade-ranking tool. That mismatch is dangerous because it silently expands the trust boundary, creates credentials on behalf of the user, and stores secrets on disk where they may be exposed through local compromise, backups, or misconfigured permissions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module performs an outbound HTTP request to a remote version-check API that is not necessary for the advertised trade-ranking function. Even if intended for maintenance, this creates an undisclosed network side effect, expands the trust boundary, and can leak usage metadata such as skill identity and invocation timing to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code stores version-check state in the user's home directory under a hidden application folder, which is unrelated to the core ranking capability. This persistent local side effect can surprise users, create unwanted filesystem artifacts, and retain metadata about skill usage without clear consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly encourages sending `requestParams`, `responseData`, and detailed `context` to a remote error-reporting API. Although it states that sensitive fields are 'automatically desensitized', it does not define the masking scope, guarantees, or require user/operator consent before transmitting potentially sensitive business data, identifiers, or model context. In a skill environment, error payloads often contain raw inputs, outputs, and stack traces, which can leak confidential data if reported broadly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function forwards a user-supplied `context` field and request metadata to `/agent/skill/error/report` without any visible redaction, content filtering, or user-facing disclosure. If upstream callers include sensitive data in `context` or `requestPath`, this can leak potentially confidential request contents to a platform telemetry endpoint, creating a privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The version check sends the skill name to a remote API without any visible consent, notice, or local-only mode at the call site. This creates a privacy and transparency issue because remote operators can infer installed skills and usage cadence, and users are not given an opportunity to approve or suppress the transmission.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 90% confidence
• Finding: The skill directs reading the user's ~/.upkuajing/.env file and storing API keys there, which is credential access and persistence in a sensitive local path. Even if intended for setup, this pattern exposes secrets to the skill runtime and normalizes direct handling of credential files, increasing risk of leakage, misuse, or accidental disclosure through logs or subsequent tooling.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 90% confidence
• Finding: The workflow explicitly allows automatic application for a new API key and saving it into ~/.upkuajing/.env, combining credential generation with local secret persistence. In context, this is more dangerous because the skill also performs paid operations and outbound network activity, so mishandled credentials could enable unauthorized charges, account actions, or continued access beyond the immediate query task.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 86% confidence
• Finding: This code path is part of logic that checks for and manages a .env file containing an API key, indicating local credential handling within the skill. In this skill context, credential storage is unnecessary to the declared analytics purpose and increases the chance of secret disclosure through file exposure, weak permissions, or accidental inclusion in logs/backups.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 88% confidence
• Finding: The script reads an existing .env file to obtain an API key, which is credential access behavior. In a top-N trade-ranking skill, this broadens access to sensitive secrets without clear need and can expose credentials if the file is improperly protected or if downstream code later mishandles the value.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: The code writes a newly issued API key to a .env file, persisting a live credential on disk. Storing secrets in plaintext files is dangerous because they are commonly copied into backups, exposed by permissive filesystem settings, or inadvertently committed/shared, and the risk is less justified given the skill's narrow analytics purpose.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including releases with breaking changes or newly introduced supply-chain risk. While not an immediate exploitable flaw by itself, unpinned dependencies reduce build reproducibility and can expose the skill to vulnerable or malicious upstream versions over time.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False for /agent/auth/create codifies an insecure default for a sensitive operation. Even if intended for convenience, making secret issuance unauthenticated lowers the barrier for abuse and is more dangerous here because users would not expect an analytics skill to provision credentials at all.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 90% confidence
• Finding: Using require_auth=False for /agent/auth/create codifies an insecure default for a sensitive operation. Even if intended for convenience, making secret issuance unauthenticated lowers the barrier for abuse and is more dangerous here because users would not expect an analytics skill to provision credentials at all.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58