查询分页的国家贸易列表数据 — 获取国家级别的贸易分解，包含年度、季度和月度贸易量，用于全面市场分析。支持多维度国家比较，提供跨时间段的详细贸易量分解。帮助外贸团队、市场研究人员和贸易分析师比较各国进出口贸易量、分析市场渗透率并通过结构化的国家贸易数据发现增长机会，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 11:58 AM UTC
• Version: 1.0.0

Overview

This paid trade-data skill is mostly coherent and disclosed, but users should understand that it stores an API key locally and includes account/recharge support flows.

Install only if you are comfortable sending trade search parameters to Upkuajing, storing the UPKUAJING_API_KEY in ~/.upkuajing/.env, and using a paid API. Confirm each charged query separately, review account or recharge actions before opening payment links, and consider restricting permissions on the local .env file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares only environment requirements but instructs the agent to read local files, write credentials to ~/.upkuajing/.env, and make networked billing/account operations. This capability gap weakens sandboxing and user expectations because a seemingly simple data-query skill can also access secrets and persist data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a trade-data lookup, but the skill also covers API key issuance, account inspection, recharge order creation, pricing lookup, version checks, and local cache/task file creation. This mismatch is dangerous because users or orchestration systems may invoke the skill for harmless analytics while unintentionally enabling credential, billing, and filesystem operations outside the stated scope.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key lifecycle management, account lookup, recharge-order creation, and pricing queries even though the declared skill is only for querying country trade-list data. That scope mismatch is dangerous because it adds privileged billing and credential capabilities that a user would not reasonably expect from this skill, increasing the blast radius if the skill is misused or invoked unintentionally.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill can create recharge/payment orders via /agent/auth/pay/url, which is unrelated to a country-trade-list query function. Exposing payment initiation inside a data-query skill creates a hidden financial capability that could be abused to trigger unauthorized billing workflows or social-engineer users into completing payments.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can request a new platform API key and persist it locally, a credential-management capability not justified by the skill's stated purpose. Embedding credential issuance in an unrelated skill increases the chance of secret sprawl, unauthorized provisioning, and accidental exposure of valid platform credentials.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file exposes account-information and pricing-management capabilities that are not necessary for returning trade-list query results. While less severe than credential issuance or payment creation, these features leak financial metadata and broaden the operational scope of the skill beyond what users expect.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The module adds behavior unrelated to the stated trade-query purpose: it performs outbound network requests to a remote version API and writes persistent local cache data under the user's home directory. Even if intended for update notifications, this expands the skill's trust boundary and introduces undisclosed telemetry/persistence that can be abused if the API base URL is untrusted or the feature is not expected by users.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: A country trade query skill should not need self-update or version-telemetry code to fulfill its functional purpose. This capability creates an unnecessary outbound communication channel and can expose metadata about installed skills or be repurposed for tracking, especially because the check runs automatically on API use rather than through a separate update workflow.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The helper posts caller-supplied params directly to a remote API endpoint without any user-facing disclosure, consent boundary, or field-level minimization. In a skill context, this can cause users to unknowingly transmit sensitive business inputs, identifiers, or search criteria to an external service beyond what the manifest clearly states.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The code posts the skill name to a remote API without any visible user-facing notice or consent. While the transmitted field is limited, it still reveals installation/use metadata and can contribute to profiling or inventorying deployed skills when combined with server logs.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 88% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: httpx>=0.23.0

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: auth=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: require_auth=False

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196