查询分页的国家贸易列表数据 — 获取国家级别的贸易分解，包含年度、季度和月度贸易量，用于全面市场分析。支持多维度国家比较，提供跨时间段的详细贸易量分解。帮助外贸团队、市场研究人员和贸易分析师比较各国进出口贸易量、分析市场渗透率并通过结构化的国家贸易数据发现增长机会，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:50 AM UTC
• Version: 1.0.1

Overview

This skill appears intended to query a paid customs-trade API, but it also handles API keys, recharge orders, diagnostics, and an automatic version check in ways that deserve manual review before installation.

Install only if you are comfortable giving this skill access to your Upkuajing API account and local ~/.upkuajing files. Avoid printing or sharing the API key, review recharge-order and paid-query confirmations carefully, and do not approve diagnostic reports unless you have checked that the context, request, and response data do not contain secrets or sensitive business information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises only a data-query use case, but its instructions require capabilities to read environment files, write local credential files, and make networked side-effecting calls. Undeclared sensitive capabilities reduce transparency and bypass least-privilege expectations, increasing the chance that an agent or user will authorize broader access than intended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is country trade-list retrieval, but the documented behavior includes credential provisioning, local secret storage, account inspection, billing/recharge flows, remote error reporting, and version-check caching. This mismatch is dangerous because users may invoke a seemingly narrow analytics skill without realizing it can modify local files, trigger paid actions, or send additional data to remote services.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements authentication management, API key issuance, account balance lookup, and recharge order creation, which materially exceeds the declared purpose of a country trade list query skill. This kind of capability mismatch is dangerous because it expands the skill’s trust boundary and can trigger billing, credential handling, or account-side effects that users would not reasonably expect from a read-oriented analytics skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Creating recharge orders is a financial side-effect unrelated to paginated trade list retrieval. In the context of a data-query skill, exposing payment initiation increases the risk of unauthorized charges, confused-deputy behavior, or social engineering through an unexpectedly privileged tool.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code can request new API keys and persist them locally, which is broader than the declared trade-query function. Even if intended for setup convenience, credential lifecycle management inside a query-focused skill increases exposure of secrets and enables unanticipated privileged behavior.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The module docstring openly states it provides API key application and recharge features, directly contradicting the skill’s declared trade-list purpose. This mismatch is a strong indicator of hidden or poorly scoped functionality, which is especially risky in agent ecosystems where users rely on metadata to assess trust and side effects.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This module adds behavior outside the declared trade-list business purpose: it performs outbound network requests and writes local state under the user's home directory. Even if intended for update checks, this expands the skill's trust boundary, creates undisclosed side effects, and can leak environment metadata or be abused if the configured API endpoint is untrusted or compromised.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs agents to send request parameters, response data, and error context to an error-reporting endpoint, which can include user data, prompts, model outputs, stack traces, and other sensitive operational details. Although it mentions automatic masking of sensitive fields, it does not define what is masked, require minimization, or warn operators to avoid including personal, confidential, or high-sensitivity data, so it creates a real privacy and data-sharing risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends an arbitrary 'context' field and request metadata to a remote endpoint via make_request('/agent/skill/error/report', params) without any visible redaction, minimization, or disclosure. If context contains user inputs, request contents, tokens, business data, or stack traces, sensitive information could be exfiltrated to the platform unintentionally during error handling.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The code sends the skill name to a remote API during version checks without any disclosure or consent mechanism in this file. While the data sent is limited, it still reveals installed-skill metadata and creates an unexpected outbound communication path that users may not anticipate.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs checking for and handling an API key stored in ~/.upkuajing/.env, and describes workflows that can read existing secrets or create new ones and save them locally. Accessing and managing credentials from a general-purpose skill is sensitive because it can expose secrets, expand account access, and normalize secret handling outside a dedicated trusted authentication flow.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: The documented flow allows a new API key to be obtained and automatically written to ~/.upkuajing/.env, which is a privileged credential write operation. If abused or implemented loosely, this can overwrite secrets, persist unauthorized access, or cause users to trust a skill with account-bootstrap actions unrelated to simple trade-data queries.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: The code writes a newly issued API key in plaintext to a .env file, creating a persistent local secret that may be exposed through weak file permissions, backups, logs, or other tooling that reads environment files. In a skill that is supposed to perform trade queries, this unnecessary credential persistence materially increases the blast radius of compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is only lower-bounded (httpx>=0.23.0) and not pinned to a specific version or constrained range, which can cause non-reproducible builds and accidental adoption of a later vulnerable or breaking release. In a skill that likely performs network requests for trade data, silently pulling a newly released httpx version could introduce security regressions or supply-chain risk during installation or deployment.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196