查询美国进口交易统计 — 按州或城市维度返回美国进口交易统计，包含进口记录数、集装箱数及近90天数据，支持游标分页。提供精细化的美国进口情报，含地理维度分解，助力精准市场分析。帮助外贸团队、物流分析师和瞄准美国市场的贸易从业者监控美国进口活动、分析集装箱流动态、评估州级和城市级进口分布，基于真实的美国海关进口数据评估市场进入策略。

• Outcome: Review
• Latest audit: Jul 20, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This paid API skill is mostly coherent, but it bundles credential storage, account/recharge actions, and an undocumented version check that users should review before installing.

Install only if you are comfortable with a paid third-party API skill that reads or writes ~/.upkuajing/.env, can create an API key, can create a recharge/payment order URL, and sends requests to openapi.upkuajing.com. Confirm each paid query separately, avoid displaying the .env file contents in chat or logs, and consider managing the API key through a safer secret store if your environment supports one.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly includes reading environment secrets, accessing files under the user's home directory, writing configuration data, and making network requests. This is dangerous because the host or user may authorize the skill under incomplete assumptions, preventing informed consent and weakening sandboxing or policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a read-only import statistics query tool, but it also instructs the agent to perform account-management and billing operations such as creating API keys, creating recharge orders, checking account info, and writing state into the user's home directory. That mismatch is risky because a user invoking a data lookup skill may not expect side effects involving credentials, payments, or persistent file changes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements authentication and billing management for an external platform, which is materially unrelated to the declared skill purpose of querying US import statistics. This capability mismatch expands the trust boundary: a user invoking a data-query skill may unknowingly trigger account, key-management, or payment workflows, creating risk of credential handling and unauthorized charges.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create recharge/payment orders even though the skill is presented as a statistics-query tool. In this context, payment initiation is an unjustified sensitive capability that could be abused to generate charges or payment links without users expecting any financial side effects.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill can request a new API key and persist it locally, which is a privileged account-management operation unrelated to a simple analytics/query skill. Bundling key issuance and local secret storage into this context increases the chance of silent credential creation, misuse across skills, and accidental disclosure of newly provisioned secrets.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This module introduces outbound network communication to a version-check endpoint that is unrelated to the skill's stated purpose of querying U.S. import statistics. Even if intended for maintenance, hidden or undocumented network access expands the attack surface, can leak usage metadata such as installed skill names and timing, and creates a supply-chain/update-channel trust dependency outside the core function.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The code persists version-check state in the user's home directory, which is not necessary for the declared import-statistics functionality. While the data stored is limited, unexpected filesystem writes create privacy and integrity concerns, leave artifacts on the host, and can be abused as part of broader persistence or tracking behavior when combined with unrelated network checks.

Credential Access

High

• Category: Privilege Escalation

Content

### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 88% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果未设置，请让用户选择：
1. 用户已有密钥：用户提供（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：通过界面申请（`auth.py --new_key`），新密钥会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 87% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: httpx>=0.23.0

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: auth=False

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: require_auth=False

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196