查询美国进口交易统计 — 按州或城市维度返回美国进口交易统计，包含进口记录数、集装箱数及近90天数据，支持游标分页。提供精细化的美国进口情报，含地理维度分解，助力精准市场分析。帮助外贸团队、物流分析师和瞄准美国市场的贸易从业者监控美国进口活动、分析集装箱流动态、评估州级和城市级进口分布，基于真实的美国海关进口数据评估市场进入策略。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches a paid trade-data lookup use case, but it also handles plaintext API keys, billing-related flows, error reporting, and an undisclosed version check that users should review before installing.

Install only if you are comfortable with this skill using a paid Upkuajing API account, storing an API key in ~/.upkuajing/.env, creating recharge/payment links on request, and sending optional diagnostic reports to the provider. Avoid letting the agent print or share the raw .env contents, and review any payment or error-report action before approving it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares itself as a simple data-query tool, but its instructions clearly require access to environment variables, local files, and external networked services. Missing explicit permission declaration reduces transparency and consent, making it easier for a user or host agent to invoke capabilities with broader reach than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is import-statistics lookup, but the skill also instructs the agent to handle API key provisioning, read account data, initiate recharge/payment flows, query pricing, and send error reports. This behavior expansion increases the attack surface and can surprise users with credential handling, billing actions, and outbound data transmission unrelated to the core query task.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication, API key issuance, account balance lookup, and recharge ordering even though the skill is described as a US import statistics query tool. This capability mismatch expands the attack surface and introduces monetization and credential-handling behaviors that users would not reasonably expect from this skill, making abuse or deceptive use materially more dangerous in this context.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Creating recharge/payment orders is unrelated to customs data lookup and introduces a financial-operation capability into a read-oriented analytics skill. In a mismatched skill context, this can facilitate unexpected charges, phishing-style payment flows, or conceal monetization logic behind an innocuous description.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code can request new API keys and persist them locally, which exceeds the reasonable functional boundary of a statistics-query skill. Even if not overtly malicious, hidden credential provisioning and storage in an unrelated skill increases the chance of unauthorized account creation, secret sprawl, and user confusion about what data or billing identity is being used.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Account balance and pricing queries are not directly required to fulfill the advertised import-statistics function. Their presence broadens the available operational and commercial metadata exposed by the skill and may support unanticipated billing workflows or reconnaissance about the user's platform account.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This script introduces outbound error-reporting functionality that is not part of the stated customs-statistics skill behavior. Although telemetry and support reporting can be legitimate, the code sends request metadata and free-form context to a remote endpoint, which can expose sensitive operational or user-derived information if the context contains prompts, identifiers, or API data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module performs outbound network access and emits upgrade behavior unrelated to the skill’s declared purpose of querying U.S. import statistics. Even though framed as version checking, this creates an undeclared side channel and expands the trust boundary, allowing metadata transmission and remote influence over local behavior without explicit user consent.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code creates and updates a persistent cache file under the user’s home directory despite the skill being presented as a read-oriented data query tool. This is risky because it introduces undeclared local state, can leak usage patterns or installed-skill metadata, and violates least surprise for a skill that should not need persistent writes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill contains self-update/version telemetry functionality that is not justified by its customs-statistics purpose. Such logic can be abused for tracking or as a precursor to update-channel abuse, and in this context it is more suspicious because it is ancillary functionality outside the stated business purpose.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API documentation explicitly supports sending requestParams, responseData, and context to a remote error-report endpoint, but it does not warn users that these fields may contain sensitive business data, credentials, personal data, or model/agent context that leaves the local environment. In an agent-skill setting, automatic exception reporting can easily exfiltrate data from failed requests unless users are clearly instructed to minimize, redact, and obtain consent before transmission.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The call to make_request('/agent/skill/error/report', params) transmits error context off-box without any visible disclosure, confirmation, or filtering in this script. If context includes user inputs, request paths, IDs, or internal error details, this can create unintended data exfiltration and privacy leakage during failure handling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The version check posts the skill name to a remote API without any user-facing notice or confirmation. While the transmitted field is limited, it still discloses installed/used skill metadata and enables passive usage telemetry, which is unjustified for a statistics-query skill and therefore more concerning in context.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs the agent to inspect a local secrets file and manage an API key stored in ~/.upkuajing/.env. Accessing and potentially modifying a credential store is sensitive behavior; if mishandled, it can expose secrets, overwrite valid credentials, or normalize unsafe secret-handling practices in a skill that appears to be only a data lookup tool.

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: The workflow continues from checking ~/.upkuajing/.env into credential provisioning and storage, including saving a newly issued API key to a local env file. This expands sensitive credential handling beyond the stated task and creates opportunities for unauthorized persistence, leakage, or manipulation of account access.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: The script writes a newly issued API key to a plaintext .env file in the user's home directory, which can expose credentials to other local users, backups, tooling, or accidental inclusion in archives. In a skill that is not expected to manage secrets, this hidden persistence behavior is especially risky because users may not realize credentials are being stored on disk.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 88% confidence
• Finding: The error message includes the exact environment file path and instructs the user to set the API key manually, reinforcing insecure secret-handling patterns and potentially leaking sensitive filesystem layout information. Combined with plaintext secret storage, this encourages operational practices that increase credential exposure risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 90% confidence
• Finding: The dependency is specified with a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any future major or minor release. That can introduce known-vulnerable or incompatible versions through supply-chain drift, and it also reduces build reproducibility across environments and over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196