Query US import transaction statistics — retrieve import records, container counts, and last-90-day data grouped by state or city dimensions, with cursor-based pagination. Provides granular US import intelligence with geographic breakdowns for targeted market analysis. Designed for export teams, logistics analysts and trade professionals targeting the US market who need to monitor US import activity, analyze container flow patterns, assess state-level and city-level import distribution and evaluate market entry strategies based on real US customs import data.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:51 AM UTC
• Version: 1.0.1

Overview

The skill mainly supports paid US import-statistics lookups, but it also handles plaintext API keys, billing flows, error reporting, and an automatic update check in ways users should review carefully.

Review before installing. Use this skill only if you trust UpKuaJing with your customs-query activity and API account. Avoid printing ~/.upkuajing/.env, treat the stored API key as a secret, and understand that queries can incur fees, top-up flows can generate payment URLs, error reports can send diagnostic context, and normal API calls also perform an update check that writes a cache under your home directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares a narrow statistics-query purpose but requires capabilities consistent with reading environment variables, reading and writing local files, and making network requests without explicitly surfacing those permissions. This reduces transparency and can cause an agent or user to authorize broader access than expected, increasing the chance of unintended credential exposure or local state modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior extends well beyond querying import statistics: it can create API keys, persist them to disk, inspect account state, initiate payment flows, query pricing, and report errors to a remote platform. This description-behavior mismatch is dangerous because users invoking a data lookup skill may unknowingly trigger credential management, billing, or external data-sharing actions outside the expected trust boundary.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements API key issuance, account inspection, recharge-order creation, and pricing lookup, which materially exceeds the declared purpose of a US import-statistics query skill. In this context, adding credential lifecycle and billing capabilities broadens the attack surface and creates opportunities for unauthorized account creation, account probing, and financial actions unrelated to the advertised functionality.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The ability to create recharge or payment orders is a sensitive financial capability and is unjustified for a read-oriented import-statistics skill. Even if it only returns a payment URL, exposing this operation in a broadly triggered skill can facilitate unexpected billing flows, phishing-style user redirection, or abuse of linked accounts.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Requesting new API keys and persisting them locally introduces credential-management behavior that is not necessary for a simple analytics/query skill. This can lead users to unknowingly create and store secrets, increasing the risk of credential leakage, misuse by other local processes, or confusion about what account was provisioned.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This module introduces behavior unrelated to the stated skill purpose of querying US import statistics: it performs outbound network requests to a version endpoint and writes persistent data under the user's home directory. Even if intended for benign update notifications, this expands the skill's trust boundary, creates undocumented data flow, and could be abused for tracking, unexpected egress, or policy bypass in environments that only expect data-query functionality.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code writes an API key to a local .env file without an explicit pre-write warning or confirmation at the moment of persistence. Storing secrets in plaintext configuration files can expose them to other local users, backups, tooling, or accidental commits, especially when the user may not expect a query skill to create credential files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script forwards request metadata and a free-form `context` field to a remote `/agent/skill/error/report` endpoint, and there is no visible minimization, redaction, consent, or disclosure mechanism in this file. If `context` or `requestPath` contains user data, credentials, prompts, or internal identifiers from failed skill executions, sensitive information could be exfiltrated to the platform unintentionally. In this skill context, an error-reporting helper is expected, but because the skill handles import-query workflows and arbitrary exception text, operational and user data may realistically appear in reports, making the issue materially risky rather than purely theoretical.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: The skill instructs checking and displaying the contents of ~/.upkuajing/.env, which is a credential store containing the API key. Reading or exposing secrets from a local env file creates a direct credential-access path and may leak the key to the model context, logs, or user-visible output.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 96% confidence
• Finding: The skill directs the agent to inspect ~/.upkuajing/.env and to automatically save newly issued API keys there. This combines credential discovery with local persistence, increasing the risk of secret leakage, accidental overwrite, insecure file permissions, and unauthorized reuse by other processes or future sessions.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 86% confidence
• Finding: This code explicitly targets a .env file for API key discovery and management, indicating direct handling of credentials in plaintext local storage. In the context of a data-query skill, this is more dangerous because users would not reasonably expect secret-management behavior, increasing the chance of unnoticed exposure.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 86% confidence
• Finding: Reading the contents of a local .env file to parse an API key is credential access behavior and expands the sensitivity of the script. If the file permissions are weak or the path is user-shared, this increases the likelihood of secrets being exposed or mishandled, especially given the unrelated skill purpose.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 94% confidence
• Finding: Opening a .env file for writing to store a newly issued API key is a direct plaintext credential persistence action. This creates substantial exposure risk through local compromise, developer tooling, backups, or accidental repository inclusion, and is especially problematic because the skill is presented as an import-statistics utility rather than a credential manager.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer versions of httpx that introduce breaking changes or newly disclosed vulnerabilities. This weakens reproducibility and supply-chain control, which is relevant for a network-facing skill that likely performs external HTTP requests to retrieve import statistics.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: This duplicate finding highlights the same unsafe default: a sensitive provisioning request is made with authentication explicitly disabled. In a skill whose advertised role is passive data querying, such a default is more suspicious and increases the potential for backend abuse if exposed broadly.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: This duplicate finding highlights the same unsafe default: a sensitive provisioning request is made with authentication explicitly disabled. In a skill whose advertised role is passive data querying, such a default is more suspicious and increases the potential for backend abuse if exposed broadly.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58