查询进出口贸易趋势数据 — 按月份维度返回指定时间范围内的贸易总量趋势数据，支持游标分页流畅浏览。提供时间序列贸易情报，可视化贸易流动态和季节性波动。帮助贸易分析师、供应链经理和市场研究人员跟踪贸易轨迹变化、监控月度贸易量波动并识别周期性模式，为预测和战略规划提供数据支撑，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

The skill largely matches its paid trade-data purpose, but it needs Review because it stores and partially displays API credentials locally and performs under-disclosed version-check telemetry.

Review before installing if this will run on a shared machine or with a paid API account. Expect it to store an Upkuajing API key under ~/.upkuajing/.env, make provider network calls, create recharge payment URLs when requested, and send diagnostic reports only after confirmation; avoid including secrets or private business data in any error-report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares only minimal metadata but instructs use of capabilities that access environment variables, read and write local files, and make network requests. This is dangerous because the effective behavior exceeds what a user would reasonably expect from the declared scope, reducing transparency and making sensitive operations harder to review or constrain.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a trade-trend query tool, but its instructions also cover API key issuance, local credential storage, account and balance inspection, recharge order creation, pricing lookup, exception reporting, and local version-cache behavior. That mismatch is dangerous because users may authorize a seemingly narrow data-query skill without realizing it can handle credentials, billing-related actions, and additional outbound communications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document instructs callers to submit request parameters, response data, and error context to an error-reporting endpoint, which can easily include sensitive business data, identifiers, stack traces, or user-provided content. Although it mentions automatic masking of sensitive fields, it does not define what is masked or require explicit minimization/consent, so operators may over-share data into centralized logs and telemetry.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script sends an error report to a remote endpoint and includes a caller-supplied `context` field, with no minimization, redaction, or explicit disclosure at the point of use. In an agent/skill environment, error context can easily contain request payloads, identifiers, or other sensitive operational data, so this creates a real data-exposure risk even if the feature is intended for diagnostics.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This code performs an outbound network request that transmits the local skill name to a remote API during normal operation, but the file provides no user-facing notice or consent mechanism. While the data sent is limited and the apparent purpose is routine version checking, it still creates silent metadata exfiltration about installed skills and usage timing, which is a legitimate privacy and transparency issue.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 93% confidence
• Finding: The skill explicitly instructs reading and writing API secrets in ~/.upkuajing/.env and automates key generation and local persistence. This is dangerous because it normalizes direct credential handling in a general-purpose skill context, increasing the risk of secret exposure, accidental leakage, overwriting existing credentials, or unauthorized reuse by other local processes.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 92% confidence
• Finding: This section continues the credential-access workflow by directing the system to inspect ~/.upkuajing/.env for an API key and, if absent, facilitate creation and storage of a new one. In context, this expands the skill from data retrieval into sensitive credential management, which materially raises the security risk and the chance of exposing or mishandling authentication material.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 82% confidence
• Finding: The script writes a newly issued API key into a plaintext .env file under the user's home directory without explicitly setting restrictive filesystem permissions. On multi-user systems or insecure environments, this can expose the credential to other local users or backup/sync tooling, enabling unauthorized API access.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 91% confidence
• Finding: On failure paths, the script instructs the user to manually set the API key as an environment variable and returns the secret file path, but more importantly earlier logic reveals the first 10 characters of any existing key in a user-facing message. Partial disclosure of a secret is unnecessary and can aid credential identification, debugging leaks, or social engineering.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only constraint (httpx>=0.23.0), which allows future unreviewed versions to be installed and can also lead to non-reproducible environments. This increases supply-chain and stability risk because a later release could introduce a breaking change or a vulnerable version range without the skill author explicitly reviewing and pinning it.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196