查询进出口贸易趋势数据 — 按月份维度返回指定时间范围内的贸易总量趋势数据，支持游标分页流畅浏览。提供时间序列贸易情报，可视化贸易流动态和季节性波动。帮助贸易分析师、供应链经理和市场研究人员跟踪贸易轨迹变化、监控月度贸易量波动并识别周期性模式，为预测和战略规划提供数据支撑，覆盖全球 220 多个国家和地区。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 4:53 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed paid trade-data API helper, with local API-key storage and billing support that users should understand before use.

Install only if you are comfortable with a paid API skill that stores its API key in ~/.upkuajing/.env, contacts openapi.upkuajing.com, can show account/balance details, and can create recharge orders when you request that flow. Confirm costs before every query, protect the .env file, and be aware that the scripts perform a daily version check with a local cache.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares only minimal metadata, but its documented behavior includes access to environment variables, local files, and remote APIs. This undeclared capability expansion weakens user consent and reviewability because a user expecting a simple data lookup may not realize the skill can read/write credential files and perform account-related network actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is a monthly trade-trend query, but the skill also documents credential provisioning, credential storage, account inspection, recharge flows, price queries, and local caching/version checks. This mismatch is dangerous because it broadens the attack surface beyond the advertised function and can lead users or orchestration systems to authorize sensitive actions they did not expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements authentication and account-management functions, including API key issuance and recharge ordering, which materially exceed the declared scope of a read-oriented trade-trend query skill. This scope mismatch is dangerous because users or orchestration systems may invoke a seemingly harmless data skill that can actually create credentials and initiate financially relevant account actions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: Creating recharge orders is a state-changing billing capability unrelated to the advertised trade-trend lookup behavior. In a skill expected to be read-only, hidden billing actions increase the risk of unauthorized purchases, abuse through agent automation, or user deception.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill exposes account and balance information unrelated to trade trend retrieval, expanding access to sensitive operational data without clear necessity. While not directly destructive, this increases information disclosure risk and broadens the blast radius if the skill is invoked in the wrong context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code can request a new API key and persist it locally, which is credential lifecycle management unrelated to the core skill purpose. Embedding secret issuance in a content-query skill makes credential creation easier to trigger accidentally or through untrusted automation, increasing the risk of account abuse.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The module advertises itself as authentication management even though the skill metadata claims trade-trend querying, signaling a serious intent/behavior mismatch. Such contradictions are dangerous because they defeat user expectations, policy review, and tool-level permission assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This module performs outbound network access to a version API and writes persistent state under the user's home directory even though the skill is described as a trade-trend query tool. That creates undisclosed side effects, expands the trust boundary, and introduces telemetry/persistence behavior unrelated to the advertised function; in a skill context, such hidden behavior is security-relevant because it can be repurposed for tracking or unexpected remote dependency checks.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code extends beyond the manifest's stated purpose by implementing self-update detection and user notification logic. Behavior that exceeds the declared capability set is dangerous in agent skills because users and orchestrators may grant permissions based on the stated purpose, while hidden auxiliary behavior can create policy bypass, trust erosion, and room for future abuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes a newly issued API key directly into a local .env file without a pre-action confirmation or warning about credential storage. This can cause secrets to be created and persisted unexpectedly, especially in automated agent contexts where file writes may be opaque to the user.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The version check transmits the skill name to a remote endpoint without any user-facing disclosure in this file. Although the data sent is limited, it still constitutes outbound metadata leakage and can reveal installed capabilities or usage context, which is sensitive in some enterprise or regulated environments.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 93% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 94% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196