Query import/export trade trend data — retrieve monthly trade volume trends within a specified time range, with cursor-based pagination for smooth data exploration. Delivers time-series trade intelligence to visualize trade flow patterns and seasonal fluctuations. Designed for trade analysts, supply chain managers and market researchers who need to track trade trajectory changes, monitor monthly volume variations and identify cyclical patterns for forecasting and strategic planning across 220+ countries and territories.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:49 AM UTC
• Version: 1.0.1

Overview

The skill performs the advertised paid trade-trend queries, but it also handles plaintext API keys, billing/account actions, optional error reporting, and an automatic version check with local persistence that users should review before installing.

Install only if you are comfortable with this skill managing an UpKuaJing API key in a local plaintext file, contacting UpKuaJing services, and exposing account/top-up helpers. Review any request before approving paid queries, top-up order creation, or diagnostic error reports, and avoid including confidential business data in reports or logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill documentation describes behavior that uses environment variables, reads and writes local files, and performs network operations, but it declares no corresponding permissions. This creates a transparency and sandboxing problem: a caller or platform may authorize the skill under the false assumption that it is low-privilege, while it can access credentials, persist data locally, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The stated purpose is a trade-trend query skill, but the documented behavior also includes account creation, local credential storage, billing/top-up flows, account inspection, error reporting, and background version-check activity. This scope expansion is dangerous because users may consent to a narrow data query but unknowingly invoke credential-handling, payment-related, telemetry, and persistence behaviors that increase attack surface and privacy risk.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements authentication, API-key issuance, account lookup, recharge order creation, and pricing retrieval, which are materially broader than the declared purpose of a trade-trend query skill. In a skill ecosystem, unrelated account and billing capabilities expand the attack surface and create opportunities for unauthorized credential provisioning or financial actions under the guise of analytics functionality.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The CLI exposes account-information access, recharge-order creation, and pricing queries even though the skill is described as a monthly trade-volume trend retriever. This mismatch is dangerous because users or agents invoking the skill for analytics may unknowingly trigger sensitive account or billing workflows not expected from the skill's advertised behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code can request a new API key and persist it locally, which exceeds the narrow read-only analytics purpose described for the skill. Credential issuance inside a general-purpose skill increases the risk of silent secret provisioning, misuse of newly created credentials, and user confusion about what authorities the skill actually has.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This script implements out-of-scope telemetry by reporting agent/skill errors to a platform endpoint, which is unrelated to the declared purpose of querying monthly trade trend data. Even if intended for diagnostics, it can transmit request identifiers, paths, and arbitrary context off-function, increasing data exposure and creating hidden behavior that users and operators may not expect from this skill.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The make_request call submits telemetry/error data to an external platform endpoint without any visible scope restriction, redaction, or user consent controls. In the context of a trade-trend query skill, this hidden outbound reporting is more suspicious because requestPath, requestId, and context may contain operational or sensitive information unrelated to the advertised feature set.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound network access to a version endpoint and writes persistent state under the user's home directory, which is unrelated to the declared purpose of querying customs trade trends. In an agent-skill context, undocumented side effects and telemetry increase attack surface, can leak installation/use metadata, and may bypass user expectations or organizational controls.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill embeds a self-update/version telemetry capability that reports the skill name to a remote API and caches results locally, despite the skill's stated function being trade-trend retrieval. In this context, hidden update/telemetry behavior is more suspicious because it is operationally unrelated, creates privacy and supply-chain risk, and could be repurposed to track usage or steer users toward attacker-controlled updates if the base URL is influenced externally.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly encourages sending `requestParams`, `responseData`, and `context` to an error-reporting API, which can include raw inputs, outputs, stack traces, and operational details. Although it states that sensitive fields are 'automatically masked,' it does not define what is considered sensitive, require minimization, or warn operators not to include personal, confidential, or regulated trade data, creating a real risk of oversharing into centralized logs/telemetry.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The request logging helper can persist full request parameters to disk, which may include sensitive business query inputs or identifiers. Although logging is currently disabled by default, enabling it creates local data retention without sanitization, consent controls, or access protections.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The response logging helper can write full API response bodies and status data to disk, potentially retaining sensitive commercial or account-related information locally. In a trade-data skill, this increases confidentiality risk if logs are later accessed by other local users, processes, or backup systems.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs access to `~/.upkuajing/.env` to read and persist an API key, and also supports automatically obtaining and saving a new key. Reading and writing secrets from a general-purpose dotfile increases the chance of credential exposure, unauthorized reuse, accidental disclosure in logs or outputs, and broader compromise if the host environment is shared or insufficiently isolated.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 93% confidence
• Finding: This flow explicitly tells the agent to check whether `UPKUAJING_API_KEY` is set in a local `.env` file and, if absent, to facilitate creation and automatic storage of a new key. In the context of an agent skill, this is more dangerous because it normalizes credential discovery and persistence by the tool itself rather than relying on a trusted secret-management mechanism.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 90% confidence
• Finding: The function is designed to inspect and later manage API-key material via a local .env file, which means credentials are handled in plaintext application storage. Plaintext secret handling is risky because local compromise, accidental file disclosure, backups, or repo inclusion can expose the API key and enable unauthorized API use.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 92% confidence
• Finding: The code reads the entire .env file to inspect existing API-key values, reinforcing reliance on plaintext credential storage and processing. Any component that reads plaintext secrets from disk increases the chance of leakage through file exposure, debugging, or insecure file permissions.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: The code writes a newly issued API key directly into a .env file in plaintext. Writing live credentials to disk without explicit permission hardening or secure storage creates a straightforward credential-compromise path if the host, user profile, backups, or workspace are accessible to other processes or users.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 82% confidence
• Finding: The error path continues to center credential handling around .env/manual environment-variable management, indicating an insecure secret-management design. Although this specific line is only an error message, it reflects and encourages operational patterns that can lead to secrets being stored or shared insecurely.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower-bound only (httpx>=0.23.0), which allows installation of any future major or minor release. This can introduce supply-chain risk through unreviewed breaking changes or newly introduced vulnerable versions, and it reduces build reproducibility across environments.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: Using require_auth=False for credential issuance establishes an unsafe default in the local client: a sensitive operation can be performed without prior authenticated context. In the skill context, this broadens misuse potential and makes the skill more dangerous because credential provisioning is unrelated to the advertised read-only trade-trend use case.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: Using require_auth=False for credential issuance establishes an unsafe default in the local client: a sensitive operation can be performed without prior authenticated context. In the skill context, this broadens misuse potential and makes the skill more dangerous because credential provisioning is unrelated to the advertised read-only trade-trend use case.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58