查询美国进口交易统计 — 按州或城市维度返回美国进口交易统计，包含进口记录数、集装箱数及近90天数据，支持游标分页。提供精细化的美国进口情报，含地理维度分解，助力精准市场分析。帮助外贸团队、物流分析师和瞄准美国市场的贸易从业者监控美国进口活动、分析集装箱流动态、评估州级和城市级进口分布，基于真实的美国海关进口数据评估市场进入策略。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate paid import-data API skill, but its API-key handling and account/payment helper actions need manual review before installation.

Install only if you are comfortable with a paid API client that stores a local API key and can create recharge orders after user direction. Do not let the agent print or paste ~/.upkuajing/.env; use a masked presence check or a managed secret store instead, set restrictive permissions on any local key file, and review any error report context before sending it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

API Key Disclosed Through Documented Terminal Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-43
Vulnerability Type: Plaintext credential disclosure
Risk Level: Medium

Vulnerable Code

bash

cat ~/.upkuajing/.env

text

UPKUAJING_API_KEY=your_api_key_here

Technical Analysis

The Skill instructs the user or Agent to print the complete contents of the credential file. Although reading the API key is necessary for authenticated requests, displaying the file is not required for the declared import-statistics functionality.

Command output can be retained in Agent transcripts, terminal scrollback, execution logs, screenshots, or monitoring systems. The command also prints every other value that may be stored in the same .env file, rather than checking only whether the required variable exists.

The runtime implementation in scripts/common.py already supports reading the relevant key without printing it, so this documented disclosure exceeds minimum necessary privilege and data exposure.

Attack Path

1. A user requests help configuring or troubleshooting the Skill.
2. The Agent follows the documented setup instructions and runs cat ~/.upkuajing/.env.
3. The complete plaintext API key appears in command output.
4. The output is retained in a transcript, log, screenshot, or other observable channel.
5. A party with access to that output reuses the key against the Upkuajing API.

Impact Assessment

Disclosure grants the attacker the same API authorization represented by the key. The attacker may consume paid API services, inspect associated account information through supported endpoints, or create charges until the key is revoked or its balance is exhausted.

This issue does not grant operating-system privilege escalation by itself. Its scope is the API account and capabilities assigned to the exposed credential.

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to run cat ~/.upkuajing/.env.
• Check only whether the required variable exists, without displaying its value.
• Prefer passing the key through the process environment or a platform-managed secret store.
• If diagnostic identification is necessary, display a short cryptographic fingerprint rather than characters from the key.
• Explicitly warn users not to paste API keys into chat, Agent output, tickets, or logs.
• Rotate any key that may already have appeared in retained terminal or Agent output.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API Key File Created Without Explicit Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 62-74
Vulnerability Type: Insecure plaintext secret storage permissions
Risk Level: Medium

Vulnerable Code

python

# Ensure the local configuration directory exists
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

# Store the API key in the environment file
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

The relevant source operations are:

python

UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)

with open(env_file, 'w', encoding='utf-8') as f:
    f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The Skill stores a newly issued Bearer credential in plaintext under the user's home directory but does not explicitly enforce owner-only permissions. Directory and file permissions therefore depend on the process umask and the state of any existing path.

With a permissive umask, other local users may be able to traverse the directory or read the credential file. When the file already exists, opening it with mode w truncates and overwrites it without validating its ownership, permissions, or whether it is a symbolic link.

Storing a dedicated API credential is related to the declared functionality, but relying entirely on ambient filesystem defaults is not an adequate least-privilege control for secret material.

Attack Path

1. The Skill requests a new API key from the remote service.
2. The key is written to ~/.upkuajing/.env.
3. A permissive umask or insecure pre-existing file leaves the secret readable by another local account.
4. Alternatively, an attacker able to prepare an unsafe path may exploit the absence of ownership a ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700 and verify its ownership.
• Create the credential file atomically with mode 0600, such as through os.open with O_CREAT, O_EXCL, and O_NOFOLLOW where supported.
• Apply chmod(0o600) to safely validated existing files and reject files owned by another user.
• Reject symbolic links and non-regular files before writing.
• Write to a securely created temporary file in the same directory, flush it, and atomically replace the destination.
• Prefer an operating-system credential store or platform-managed secret facility when available.
• Preserve unrelated configuration entries rather than blindly truncating an existing .env file.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/auth.py:29

Finding

Existing API Key Prefix Exposed in Program Output

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 29-34
Vulnerability Type: Partial credential disclosure
Risk Level: Low

Vulnerable Code

python

if line.startswith(f'{API_KEY_ENV}='):
    existing_key = line.split('=', 1)[1].strip()
    if existing_key:
        return {
            "success": False,
            "message": f"An API key already exists ({existing_key[:10]}...)."
        }

The disclosure is caused by:

python

existing_key[:10]

Technical Analysis

When an existing key is detected, the program embeds its first ten characters in user-visible output. This output may be captured by Agent transcripts, terminal logs, monitoring systems, or support records.

A key prefix generally does not provide the complete authentication secret, so the direct exploitability is lower than full-key disclosure. Nevertheless, exposing original credential characters is unnecessary. It can support credential correlation, identify key formats or issuers, and compound another partial disclosure.

The program only needs to report that a key exists; it does not need to reveal any portion of the credential.

Attack Path

1. A valid API key already exists in ~/.upkuajing/.env.
2. The user or Agent runs the new-key operation.
3. The program reads the key and includes its first ten characters in the returned message.
4. The message is retained in output logs or an Agent transcript.
5. An observer uses the prefix for correlation or combines it with information obtained through another disclosure.

Impact Assessment

The issue exposes only a partial credential and is not sufficient on its own to authenticate. Its primary impact is reduced credential confidentiality and increased effectiveness of correlation or combined-disclosure attacks. No operating-system privileges are obtained directly.

Remediation

View remediation

Remediation Suggestions

• Remove existing_key[:10] from all messages.
• State only that an API key is already configured.
• If operators require stable identification, calculate a short fingerprint using a cryptographic hash and clearly label it as a fingerprint.
• Ensure exception messages, debug logs, and telemetry never contain complete or partial API-key values.
• Add automated tests that reject output containing any substring of configured test credentials.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

HTTP Dependency Uses an Unbounded Minimum-Version Requirement

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

Technical Analysis

The dependency declaration accepts every httpx release from version 0.23.0 onward. Consequently, installation at different times may resolve to materially different and unreviewed versions.

SKILL.md instructs users to install this requirements file with pip, so package installation is part of the expected workflow. An unrestricted upper range weakens build reproducibility and can introduce future incompatible, vulnerable, or compromised releases without a corresponding Skill review.

No typosquatted package, malicious package source, or currently known compromised dependency was established by the audit. The finding concerns supply-chain hardening and uncontrolled future resolution.

Attack Path

1. A user installs the Skill dependencies at a later date.
2. The package resolver selects the newest release satisfying httpx>=0.23.0.
3. That release has not necessarily been compatibility- or security-reviewed with this Skill.
4. If the selected release or its transitive dependency is compromised, vulnerable, or incompatible, its installation or runtime behavior affects the user's environment.

Exploitation depends on a problematic future package release or dependency-resolution event; the audited repository does not itself provide such a payload.

Impact Assessment

Potential impact depends on the behavior of the resolved package and can range from denial of service or incorrect network behavior to execution of malicious package installation/runtime code with the privileges of the user running pip or the Skill.

The current evidence does not demonstrate active compromise, and users should not install the project dependencies with elevated privileges.

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a reviewed version or use a narrowly bounded compatible range.
• Maintain a lock file covering direct and transitive dependencies.
• Use package hashes with pip --require-hashes for reproducible installation.
• Regularly update pinned versions through a reviewed dependency-update process.
• Run vulnerability and license scanning against the complete resolved dependency set.
• Install dependencies in an isolated virtual environment without administrator privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented behavior extends beyond trade-statistics retrieval to include local version-cache reads/writes, parsing local metadata, and remote version checks. These extra behaviors expand local file and network access without being part of the declared business function, creating unnecessary attack surface and reducing transparency for users and agents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented behavior extends beyond trade-statistics retrieval to include local version-cache reads/writes, parsing local metadata, and remote version checks. These extra behaviors expand local file and network access without being part of the declared business function, creating unnecessary attack surface and reducing transparency for users and agents.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented behavior extends beyond trade-statistics retrieval to include local version-cache reads/writes, parsing local metadata, and remote version checks. These extra behaviors expand local file and network access without being part of the declared business function, creating unnecessary attack surface and reducing transparency for users and agents.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly instructs reading the contents of ~/.upkuajing/.env with cat, which can expose the full API key and any neighboring secrets in plaintext. In an agent environment, encouraging direct secret-file reads creates a clear credential exposure path and exceeds the minimum needed to verify configuration.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

本技能需要API密钥。API密钥存储在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill directs checking for and potentially storing API credentials in a local .env file, including automatic key creation and persistence. This increases credential-handling risk because local secret storage may be read by other tools, leaked through logs or support actions, or managed without adequate user understanding of where secrets are being written.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This section continues the same credential workflow by instructing the operator to inspect whether UPKUAJING_API_KEY exists in a local .env file and to add or generate one there if absent. In context, the skill is nominally a data-query tool, so embedding direct credential inspection and storage guidance makes the skill more dangerous by normalizing unnecessary secret-file access within routine operation.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file adds API key provisioning, account lookup, recharge-order creation, and pricing functions that are unrelated to the stated purpose of a read-only US import statistics skill. Expanding a skill with credential and billing capabilities increases attack surface and can enable unauthorized account creation, billing abuse, or user confusion about what the skill is permitted to do.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The code reads the entire .env file and later returns a message containing a prefix of the existing API key when one is found. Exposing even part of a secret in user-visible output or logs is poor secret-handling practice and can aid token identification, correlation, or leakage across interfaces.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The function writes a newly provisioned API key directly into a plaintext .env file under the user's home directory. Plaintext secret storage is risky because other local processes, backups, shell tooling, or misconfigured file permissions may expose the credential.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

该文件的文档和实现都表明其功能是向平台上报 Agent/Skill 调用异常，而不是按州或城市查询美国进口交易统计。对于一个声明为“查询美国进口交易统计”的技能来说，内置一个独立的异常上报网络调用属于清单未说明的额外行为，和描述的业务能力明显不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares capabilities that imply access to environment variables, local files, and networked APIs, but it does not constrain or disclose tool scope through an allowlist or permissions section. In an agent setting, this increases the chance of over-broad execution, unexpected file access, or credential handling beyond what is necessary for a trade-statistics query.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description lists trigger phrases such as “美国进口统计”, “按州查询进口”, and “按城市查询进口” without defining when the skill should or should not activate. These phrases are fairly general request patterns and the file provides no negative examples or scope boundaries to prevent unintended invocation overlap with other import/trade-related skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is entirely in Chinese and presents the skill description only in that language. This imposes a language choice on users without any opt-in or documented locale justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Including billing and credential-management logic in a customs-statistics skill violates least privilege and creates functionality far beyond user expectations. Even if intended for setup convenience, this mismatch makes the skill more dangerous because a user invoking a data lookup skill would not reasonably expect account or payment operations to be available.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The explicit require_auth=False setting establishes an unsafe default for a sensitive operation: issuing API credentials. Sensitive account lifecycle actions should default to authenticated and least-privilege behavior, not anonymous invocation.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The explicit require_auth=False setting establishes an unsafe default for a sensitive operation: issuing API credentials. Sensitive account lifecycle actions should default to authenticated and least-privilege behavior, not anonymous invocation.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends request parameters to a remote API and attaches a Bearer token for authentication, which is a privacy- and security-relevant network operation. Although the function docstring describes the mechanics, it does not provide a user-facing disclosure or warning about transmitting data off-host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill that returns U.S. import statistics by state or city with pagination, which suggests a read/query-oriented capability. This file additionally creates task directories, writes task metadata and result files, and appends persisted result data on disk, which is broader stateful behavior not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends a caller-provided context field, along with request metadata, to a remote /agent/skill/error/report endpoint without any visible minimization, redaction, consent, or warning. If context contains user prompts, API payloads, tokens, personal data, or business-sensitive content from failed requests, this creates a real data disclosure path through telemetry.

Content

No source excerpt is available for this finding.