查询进出口贸易趋势数据 — 按月份维度返回指定时间范围内的贸易总量趋势数据，支持游标分页流畅浏览。提供时间序列贸易情报，可视化贸易流动态和季节性波动。帮助贸易分析师、供应链经理和市场研究人员跟踪贸易轨迹变化、监控月度贸易量波动并识别周期性模式，为预测和战略规划提供数据支撑，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a real paid trade-data client, but it handles and exposes API credentials in ways that warrant user review before installation.

Install only if you are comfortable with this skill storing an Upkuajing API key in a plaintext home-directory file and interacting with paid account and recharge endpoints. Do not let the agent print or paste the `.env` file; prefer setting `UPKUAJING_API_KEY` through a protected environment or secret manager, and review any error report payload before sending it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Credential disclosure encouraged through direct display of the secret file

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-49
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

The Skill instructs the agent to inspect the API credential by printing the entire credential file:

bash

cat ~/.upkuajing/.env

Technical Analysis

Reading the API key is necessary for authenticated API calls, but displaying the complete credential file is not. The executable code already supports retrieving only UPKUAJING_API_KEY internally, so printing the file exceeds the minimum access and disclosure required for the declared trade-data functionality.

The command exposes the secret through standard output. In an agent environment, that output may enter model context, conversation transcripts, execution logs, observability systems, screenshots, or other retained records. The file could also contain unrelated variables in addition to the expected API key.

Attack Path

1. A user or agent encounters an authentication problem.
2. Following the Skill instructions, the agent runs cat ~/.upkuajing/.env.
3. The API key and any other values in the file are returned to the agent session.
4. The output is retained in conversation or tool logs, or becomes visible to another party with access to those records.
5. An exposed key is used against authenticated account, query, reporting, or payment-related API endpoints.

Impact Assessment

Exposure compromises the confidentiality of UPKUAJING_API_KEY. Depending on server-side authorization, an attacker may consume paid API services, inspect account information, create recharge orders, submit reports, or exhaust the account balance. If unrelated secrets are stored in the same file, the disclosure scope may be broader.

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the entire .env file.
• Test only whether the variable exists, without displaying its value.
• Prefer the declared process environment variable over a plaintext file.
• If file-based diagnostics are required, display only a redacted value such as the first four characters and never place the complete key in model context.
• Explicitly warn users not to paste credentials into chat.
• Recommend immediate key revocation and rotation if a credential has already appeared in logs or conversation history.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:64

Finding

API key file is created without enforcing restrictive permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 64-74
Vulnerability Type: Insecure plaintext secret storage
Risk Level: Medium

The newly issued API key is written to a persistent plaintext file using process-default permissions:

python

try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

Neither the ~/.upkuajing directory nor its .env file is assigned an explicit restrictive mode. Their effective permissions depend on the caller's umask and any pre-existing directory permissions. Under permissive configurations, another local account or process may be able to read the bearer credential.

The operation also uses write-and-truncate mode. If the file contains other configuration values but no nonempty UPKUAJING_API_KEY, those values are discarded when a new key is written. Although this is primarily an integrity and availability concern, it demonstrates unsafe credential-file management.

Attack Path

1. The user runs python scripts/auth.py --new_key.
2. The platform returns a new API key.
3. The script creates or rewrites ~/.upkuajing/.env without explicitly setting mode 0600.
4. A local user or compromised process checks the file where host permissions allow access.
5. The attacker extracts the bearer credential and uses it from another system.

Impact Assessment

The attacker obtains the same API authorization represented by the key. Potential effects include paid API consumption, balance depletion, account-information exposure, creation of recharge orders, and unauthorized authenticated submissions. This does not direc ...[truncated 99 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700.
• Create the credential file atomically with mode 0600, for example through os.open using O_CREAT, O_EXCL, and an explicit mode.
• Correct permissions on an existing credential file before reading or writing it, or fail safely if ownership is unexpected.
• Preserve unrelated configuration entries instead of truncating the complete file.
• Use an atomic temporary-file-and-rename procedure to avoid partially written credentials.
• Prefer an operating-system credential store or secret manager where available.
• Document key rotation and revocation procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/error_report.py:17

Finding

Exception reporting can transmit sensitive request and response content without client-side redaction

Content

View full analysis

Vulnerability Details

File Location: scripts/error_report.py, lines 17-34
Vulnerability Type: Unrestricted diagnostic-data transmission
Risk Level: Medium

The reporting function validates only the presence of required fields and then forwards the entire caller-provided object:

python

def report_error(params: dict) -> dict:
    params.setdefault('skillId', get_skill_name())
    params.setdefault('skillVersion', get_skill_version())

    for field in ('skillId', 'skillVersion', 'requestId', 'requestPath', 'context'):
        if not params.get(field):
            print(f"错误：params中缺少{field}", file=sys.stderr)
            sys.exit(1)

    response = make_request('/agent/skill/error/report', params)
    return response

The reference schema additionally permits requestParams, responseData, and free-form context. The client applies no allowlist, secret detection, field filtering, or size validation before sending these values to the remote platform.

Technical Analysis

Server-side redaction mentioned in documentation occurs only after information has crossed the client trust boundary. It cannot prevent the original request body from reaching the remote endpoint or appearing in intermediary and server request logs.

The Skill text says to obtain user confirmation before reporting, which is a useful procedural mitigation, but the script does not enforce consent or provide a preview of the exact payload. An agent can accidentally place credentials, personal data, commercially sensitive queries, stack traces, or complete API responses in the report.

Attack Path

1. An API request fails or produces unexpected output.
2. An agent constructs a diagnostic payload containing the original parameters, response, or verbose exception context.
3. Sensitive values are included in requestParams, responseData, or context.
4. The script forwards the complete object to `/agent/skill/error/rep ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

• Define a strict client-side allowlist for report fields.
• Recursively redact common secret names, including authorization, token, API key, password, cookie, and session fields.
• Do not include full response bodies or original request parameters by default.
• Reject or redact bearer-token patterns and the current UPKUAJING_API_KEY value.
• Show the user a redacted preview and require explicit confirmation of that exact payload.
• Add maximum type and length checks matching the documented server schema.
• Provide a minimal report mode containing only the request ID, endpoint, Skill version, and a short sanitized error category.

other

Note

• Location: scripts/version_check.py:91

Finding

Automatic version telemetry and persistent cache are outside the core query function

Content

View full analysis

Vulnerability Details

File Location: scripts/version_check.py, lines 91-109
Vulnerability Type: Undisclosed telemetry and unnecessary persistent state
Risk Level: Low

Every request path invokes a daily version check through make_request. The check sends the local Skill directory name to the remote service:

python

def check_skill_version(skill_name: str, api_base_url: str) -> Optional[str]:
    try:
        url = f"{api_base_url}/agent/api/skills/version"
        headers = {"Content-Type": "application/json"}

        with httpx.Client(timeout=10.0) as client:
            response = client.post(url, json={"name": skill_name}, headers=headers)
            response.raise_for_status()

            data = response.json()
            if data.get("code") == 0:
                return data.get("data")
    except Exception as e:
        print(f"Error checking skill version:{e}", file=sys.stderr)
        pass
    return None

The result and check date are stored persistently in ~/.upkuajing/version_cache.json.

Technical Analysis

Version checking is not required to execute the declared customs trend query. The network call occurs automatically before authenticated API operations rather than through an explicit update-check command. It discloses the installed Skill identifier and establishes a daily activity signal.

The returned value is only displayed as an update notice and is not executed, so this is not remote payload execution. The cache is ordinary application state rather than a startup hook or scheduled service, so it is not system persistence under T06. Nevertheless, the behavior exceeds the minimum network and filesystem activity required for the query.

Attack Path

1. The user invokes a query, account, payment, pricing, or reporting operation.
2. make_request automatically calls the version checker.
3. The checker sends the local Skill name and exposes timing and ne ...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

• Make version checking opt-in or expose it as an explicit command.
• Disclose the transmitted fields, destination, frequency, and cache location in SKILL.md.
• Provide an environment or command-line option that completely disables the check.
• Avoid creating the cache directory until the user enables version checks.
• Minimize identifying metadata and apply a clear retention policy.
• Continue treating returned versions as display-only data; never evaluate or automatically execute remote content.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Dependency is specified with no upper bound or reproducible lock

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unbounded third-party dependency
Risk Level: Medium

The complete dependency declaration is:

text

httpx>=0.23.0

Technical Analysis

The lower-bound-only declaration permits installation of any future httpx release accepted by the package resolver. Builds are therefore not reproducible, and reviewed code can later run with materially different dependency behavior.

No typosquatted package or untrusted package index is present in the audited file, and httpx is a legitimate package. The risk arises from the absence of an audited version pin, upper compatibility boundary, lock file, and integrity hashes. A compromised upstream release, dependency-chain compromise, or incompatible future release would be incorporated during a fresh installation.

Because httpx handles bearer-authenticated HTTPS traffic, a malicious dependency release would execute in the Skill process and could access process environment variables, API payloads, responses, and the user's filesystem permissions.

Attack Path

1. An attacker compromises a future allowed httpx release or one of its transitive dependencies.
2. A user runs pip install -r requirements.txt after that release becomes the newest compatible version.
3. The resolver installs the compromised package because no exact version or hash is required.
4. Malicious package code executes during installation, import, or HTTP operations.
5. The code accesses UPKUAJING_API_KEY, API traffic, and any files available to the user account.

Impact Assessment

Successful supply-chain exploitation would execute code with the privileges of the user running the Skill. This could expose the API key and trade-query data, modify user-accessible files, issue unauthorized API requests, or compromise other credentials available to that process.

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a reviewed exact version.
• Generate and commit a lock file that includes all transitive dependencies.
• Require package hashes during installation, such as through a hash-locked requirements file.
• Use a trusted package index and disable unintended extra indexes.
• Add automated dependency vulnerability and provenance scanning.
• Establish a controlled update process that tests and reviews dependency changes before release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates additional version-checking, local metadata reads, and cache writes unrelated to the advertised trade-query function. Hidden update checks and local cache manipulation widen the attack surface and create undeclared network and filesystem side effects that are not obvious from the skill's stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates additional version-checking, local metadata reads, and cache writes unrelated to the advertised trade-query function. Hidden update checks and local cache manipulation widen the attack surface and create undeclared network and filesystem side effects that are not obvious from the skill's stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates additional version-checking, local metadata reads, and cache writes unrelated to the advertised trade-query function. Hidden update checks and local cache manipulation widen the attack surface and create undeclared network and filesystem side effects that are not obvious from the skill's stated purpose.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs reading and displaying the contents of ~/.upkuajing/.env, which may reveal the API key in plaintext. Exposing secrets in terminal output or chat transcripts can lead to credential theft, unauthorized API usage, account compromise, and downstream billing abuse.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Referencing cat ~/.upkuajing/.env directly creates a credential-access pattern that can disclose the stored API key. In the context of an agent skill, this is especially risky because the secret may be surfaced to logs, model context, or user-visible responses.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The workflow directs checking for a key in a local .env file and instructs users to manually add credentials there, creating a path for unsafe credential handling and accidental disclosure. Manual secret placement in ordinary files increases the likelihood of exposure through shell history, backups, permissions misconfiguration, or later file reads.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This step continues the unsafe secret-management pattern by centering operational flow around inspecting and populating ~/.upkuajing/.env. In a skill that also performs network and billing actions, compromised API credentials could directly enable unauthorized paid API calls and account abuse.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file implements authentication lifecycle, account inspection, recharge-order creation, and pricing lookup, which materially exceeds the declared purpose of a trade-trend query skill. Capability mismatch is dangerous because users or hosting agents may grant trust and permissions based on the advertised data-query scope while the code introduces financial and credential-management operations that expand the attack surface.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The function is explicitly designed to inspect a local .env file for an existing API key, meaning the skill handles credentials directly from a plaintext secret store. Direct credential access is risky because secrets in .env files are commonly overexposed via weak file permissions, backups, logs, or accidental inclusion in archives.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Opening and reading the .env file to parse credentials confirms that the skill performs local credential retrieval as part of its normal workflow. In a skill whose stated purpose is trend-data querying, this is more dangerous because secret access is unexpected and broadens the consequences of compromise or misuse.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Writing a newly issued API key to a .env file stores a live credential in plaintext on disk. Plaintext persistence materially increases exposure to local compromise, accidental disclosure, and unauthorized reuse, especially in shared environments or when the skill directory is synchronized or backed up.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating recharge orders is a financial operation unrelated to monthly trade trend retrieval, so embedding it in this skill introduces an unnecessary monetization/payment surface. In the context of a data-query skill, this increases the risk of unauthorized charges, phishing-style payment redirection, or abuse through hidden side capabilities users would not reasonably expect.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements an error-reporting capability that sends data to a platform endpoint, which is outside the skill’s declared purpose of querying trade trend data. In a skill context, undeclared secondary network behavior increases supply-chain risk because request metadata and context may be exfiltrated without clear necessity or user awareness.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares capabilities that include environment access, local file access, and networked operations, but it does not constrain or disclose them via an explicit tool/permission scope. That increases the risk of over-broad execution, especially because the workflow includes credential-file handling and remote API operations unrelated to the narrow user-visible purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The error-reporting documentation encourages submitting requestParams, responseData, and free-form context, which commonly contain tokens, personal data, query contents, or internal stack traces. Although it mentions automatic masking, it does not clearly instruct developers to minimize, sanitize, or avoid sending sensitive data, creating a realistic risk of over-collection and leakage into logging/reporting systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file contains natural-language descriptions that force a specific language for users, including the module docstring and CLI help text. Under the policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code can request a new API key and persist it locally, even though the skill is advertised as a trade-trend query tool rather than a credential-provisioning utility. This mismatch makes credential handling less expected and therefore more dangerous, especially because it can silently expand access and leave sensitive secrets on disk.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Account-info and pricing-query features are not necessary for fulfilling the stated task of returning trade trend data. In this context they disclose commercial/account metadata and broaden reachable backend functions, which can aid reconnaissance or misuse beyond the expected data-query workflow.

Content

No source excerpt is available for this finding.