Query paginated national trade list data — retrieve country-level trade breakdowns with annual, quarterly, and monthly trade volumes for comprehensive market analysis. Enables multi-dimensional country comparison with detailed trade volume decomposition across time periods. Designed for export teams, market researchers and trade analysts who need to compare import-export volumes across countries, analyze market penetration and identify growth opportunities through structured country trade data across 220+ countries and territories.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

This paid trade-data skill is transparent about using UpKuaJing APIs, credentials, billing, and optional support reporting, though users should understand the payment and plaintext API-key storage model before installing.

Install only if you are comfortable using UpKuaJing's paid API, storing an API key under ~/.upkuajing/.env, and manually confirming any paid query, top-up order, or error report. Avoid putting extra sensitive details in error-report context, and protect or rotate the API key like any other credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions, but its documented behavior includes reading environment variables, accessing and writing files under ~/.upkuajing, and making network calls. This creates a transparency and consent problem: an operator may invoke a seemingly simple data-query skill without realizing it can access credentials, persist secrets, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a paginated trade-list query tool, but it also handles API key issuance, account/balance inspection, recharge order creation, pricing lookups, remote error reporting, and local caching/version metadata. That mismatch expands the attack surface and can mislead users or orchestration systems into granting broader trust than warranted for a simple analytics skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script is explicitly an authentication and billing manager, including API key issuance and recharge support, which exceeds the stated purpose of a paginated country trade query skill. In a skill advertised for data retrieval, adding account-management and payment-related capabilities broadens the attack surface and can enable unauthorized financial or account actions if invoked unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Creating recharge/payment orders is unrelated to querying trade breakdown data and gives the skill transactional capability with financial implications. In this context, that mismatch is dangerous because a user or orchestrator may trust the skill as read-only market analysis tooling while it can trigger billing workflows against an external service.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code can request new API keys and persist them locally, which is outside the expected behavior of a trade-data query skill. Although key enrollment is not inherently malicious, embedding credential lifecycle management in a data-query tool increases privilege scope and can lead to unauthorized account creation, key sprawl, or silent credential persistence.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements platform error-reporting behavior that is unrelated to the declared purpose of a paginated country trade query skill. The function sends request metadata and a free-form context field to an external endpoint, creating an unnecessary data egress path that could expose user prompts, identifiers, or internal workflow details during failures.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: For a skill whose stated role is trade-list querying, posting telemetry to '/agent/skill/error/report' is an unjustified extra capability. Because the reported payload includes requestId, requestPath, and especially context, failures may transmit sensitive operational or user-derived information to the platform without necessity for the core business function.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs agents to transmit request parameters, response data, and detailed error context to an external error-reporting API, while only stating that sensitive fields will be 'automatically desensitized' and giving no explicit user-facing consent or data-minimization guidance. Error payloads commonly contain personal data, secrets, business data, or stack traces, so this can lead to unintended disclosure to the platform if agents forward full inputs and outputs by default.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The code transmits the skill name to a remote API without any user-visible notice or consent mechanism in this module. Although the data appears low sensitivity, undisclosed outbound communication creates a privacy and governance issue, especially in environments that expect skills to only perform their stated business function.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The module writes version-check metadata to a hidden file under the user's home directory without user-facing disclosure. Even though the cached fields are minimal, silent local persistence can violate transparency expectations and may be problematic in managed or privacy-sensitive environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: The skill instructs checking ~/.upkuajing/.env for UPKUAJING_API_KEY and supports automatically applying for and storing a new key there. Accessing local secret stores and encouraging persistence of credentials in a user home directory increases exposure of sensitive material, especially if the skill runs in a shared or overprivileged environment.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 92% confidence
• Finding: This section continues the credential-access flow by directing the agent to inspect a local .env file and potentially save a newly issued API key into it. In context, the danger is elevated because the skill is nominally a trade-query tool, yet it includes credential handling that could expose secrets or normalize unsafe secret-management practices.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 87% confidence
• Finding: The code writes a newly issued API key into a plaintext .env file under the user's home directory. Persisting credentials in an unencrypted flat file increases exposure to local compromise, accidental inclusion in backups or source control, and misuse by other processes with filesystem access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including releases with breaking changes or newly introduced supply-chain risk. While not an immediate exploitable flaw by itself, unpinned dependencies reduce build reproducibility and can unintentionally pull in vulnerable or malicious versions if the package ecosystem is compromised.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: Using require_auth=False for key creation establishes an unsafe default that favors convenience over access control. Even if the backend expects anonymous key registration, embedding that behavior in a trade-query skill increases the chance of abuse, automated account generation, or unreviewed privilege expansion.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: Using require_auth=False for key creation establishes an unsafe default that favors convenience over access control. Even if the backend expects anonymous key registration, embedding that behavior in a trade-query skill increases the chance of abuse, automated account generation, or unreviewed privilege expansion.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58