T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:37- Finding
Credential File Is Explicitly Printed to Terminal Output
- Content
View full analysis
- Remediation
View remediation
Security audit
查询分页的国家贸易列表数据 — 获取国家级别的贸易分解，包含年度、季度和月度贸易量，用于全面市场分析。支持多维度国家比较，提供跨时间段的详细贸易量分解。帮助外贸团队、市场研究人员和贸易分析师比较各国进出口贸易量、分析市场渗透率并通过结构化的国家贸易数据发现增长机会，覆盖全球 220 多个国家和地区。
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its paid trade-data purpose, but it asks users to expose and store an API key in risky ways and includes account, payment, telemetry, and update-check behavior that users should review carefully.
Install only if you are comfortable with a paid third-party API skill that stores an API key under `~/.upkuajing`. Do not run or allow `cat ~/.upkuajing/.env`; provide credentials through a safer environment mechanism where possible, confirm every chargeable or recharge action separately, and avoid sending sensitive request or response data in error reports.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth.py:71- Finding
API Key Is Persisted Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Dependency Version Is Not Safely Bounded or Reproducibly Pinned
- Content
View full analysis
=0.23.0 ``` ### Technical Analysis The dependency specification accepts any current or future `httpx` version equal to or newer than 0.23.0. It does not establish an upper bound, pin a reviewed release, constrain transitive dependencies, or verify package hashes. Consequently, the documented installation command can resolve to different package versions at different times. A future incompatible, vulnerable, or compromised release could therefore enter the execution environment without a source-code change or renewed review of this Skill. The package name is legitimate and no dependency-confusion or typosquatting package was identified. The risk arises from non-reproducible and insufficiently constrained dependency installation rather than evidence that the current dependency is malicious. ### Attack Path 1. A user follows the documented installation process using `pip install -r requirements.txt`. 2. The package resolver selects the newest available version satisfying `httpx>=0.23.0`, along with its current transitive dependencies. 3. A future release or transitive package contains a vulnerability, malicious modification, or incompatible behavior. 4. The package is installed without hash verification or a reviewed lock file. 5. The affected code executes during installation or when the Skill performs network requests. ### Impact Assessment The potential impact depends on the behavior of the subsequently resolved package. Because the dependency executes inside the Python process, a compromised package could theoretically obtain the same privileges as the Skill process, including access to: - The `UPKUAJING_API_KEY` environment variable. - `~/.upkuajing/.env`. - API request parameters and responses. - Files accessible to the invoking user. - Network a ...[truncated 205 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version checking against a remote API and local cache file management are unrelated to the advertised trade-statistics function. While often legitimate, undisclosed update checks introduce extra network and filesystem behavior that can surprise users, expand telemetry exposure, and create another externally influenced code path.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Version checking against a remote API and local cache file management are unrelated to the advertised trade-statistics function. While often legitimate, undisclosed update checks introduce extra network and filesystem behavior that can surprise users, expand telemetry exposure, and create another externally influenced code path.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version checking against a remote API and local cache file management are unrelated to the advertised trade-statistics function. While often legitimate, undisclosed update checks introduce extra network and filesystem behavior that can surprise users, expand telemetry exposure, and create another externally influenced code path.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Version checking against a remote API and local cache file management are unrelated to the advertised trade-statistics function. While often legitimate, undisclosed update checks introduce extra network and filesystem behavior that can surprise users, expand telemetry exposure, and create another externally influenced code path.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The documentation explicitly instructs reading the local .env file that stores the API key. Directly accessing secret files increases the chance of credential exposure through logs, terminal output, model observation, or accidental disclosure, and this risk is amplified because the skill already performs network and billing-related actions.
- Content
本技能需要API密钥。API密钥存储在
~/.upkuajing/.env文件中：bash cat ~/.upkuajing/.env文件内容示例：
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill workflow includes checking for a local API key in a .env file and guiding users to add or auto-save the key there. Handling secrets through local plaintext files may be common, but it remains risky in agent contexts because other tools, logs, or prompts may expose those contents and because the same credential can authorize billable actions.
- Content
md ### **API密钥未设置** 首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY； 如果未设置，请让用户选择： 1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件） 2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env 等待用户选择；
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The instructions continue to center local .env inspection and modification for credential management, reinforcing a pattern of direct secret-file interaction. In this context, the danger is elevated because the skill also supports account creation, recharge, and external reporting, so compromise of the key can lead to financial abuse and data exposure.
- Content
md 首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY； 如果未设置，请让用户选择： 1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件） 2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This skill is described as a country trade list query utility, but the file implements unrelated account-management functions: API key issuance, account balance lookup, recharge order creation, and pricing queries. That capability expansion increases attack surface and can trigger sensitive side effects unrelated to the declared user task, making the skill more dangerous in context because users and reviewers would not expect financial/account operations inside a data-query skill.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Opening the .env file for writing is part of persisting a live API key in plaintext on disk. In context, this creates a real credential-exposure risk because the skill is unrelated to auth management, users may not expect local secret storage, and plaintext files are easy to leak through backups, logs, or repo commits.
- Content
python "envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code exposes a recharge-order creation action in a skill whose declared purpose is paginated national trade data lookup. Creating payment orders is a sensitive side effect that could be abused to trick users into initiating purchases or to redirect them into unexpected financial flows, and it is especially suspicious because the functionality is out of scope for this skill's business context.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for querying paginated country trade-list data for market analysis, but this file implements exception reporting to a platform endpoint instead of trade-data retrieval or analysis. While telemetry can be an internal support function, this behavior is materially different from the user-declared skill purpose and is not described in the manifest.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares capabilities that involve environment access, local file access, and network activity, but it does not define any explicit tool scope or permission boundary. That creates unnecessary ambiguity about what the skill may do at runtime and weakens least-privilege controls, especially since the skill also handles API keys and billing-related operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description lists trigger phrases such as “国家贸易分解”, “进出口国家比较”, and “按国家统计贸易量” without clear boundaries, exclusions, or a narrow invocation context. These phrases are generic within trade-analysis conversations and may cause unintended activation because the file does not specify when this skill should not be used.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document explicitly recommends sending request parameters, response data, and exception context to an error-reporting endpoint, and although it notes that sensitive fields are 'automatically desensitized,' it provides no concrete guarantees about what is redacted or when reporting is appropriate. In an agent/skill environment, these fields can easily contain user-provided business data, identifiers, or model context, so this creates a real privacy and data-minimization risk if operators forward full payloads by default.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file can request a new API key and persist it locally, which is not directly justified by a read-only trade-list query skill. In this context, hidden credential provisioning and storage create unnecessary secret-handling risk and make it easier for a seemingly harmless query skill to establish durable authenticated access.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script writes the newly issued API key directly to a local .env file without an up-front warning, consent prompt, or hardening of file permissions. This can expose credentials through accidental inclusion in backups, source-control, shared home directories, or other local processes, and the risk is more concerning because the skill is not primarily an authentication tool.
- Content