支持全球220+国家海关贸易数据，提供批量搜索工具，帮助外贸企业快速找到采购商和供应商。通过分析进出口记录，发现目标产品采购商、交易记录。支持企业查询、HS编码、产品查询。让外贸团队基于交易数据开发高价值B2B客户、掌握竞争对手交易动态。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:19 AM UTC
• Version: 1.0.10

Overview

This skill is a disclosed paid API integration for customs trade and company search, with sensitive but purpose-aligned handling of an API key, billing flow, result files, and optional error reporting.

Install only if you are comfortable giving this skill an Upkuajing API key, letting it make paid API calls after confirmation, and storing generated search results locally. Prefer setting UPKUAJING_API_KEY through your agent or shell secret mechanism rather than creating a plaintext ~/.upkuajing/.env file, and review any optional error report before sending it so it does not include secrets, customer data, or unnecessary request/response content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes capabilities to read environment variables, read/write local files, and make network requests, but does not declare equivalent permissions or clearly constrain their use. This creates a transparency and trust problem: an agent or user may authorize a seemingly simple search skill without realizing it can access credentials, persist data locally, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description presents the skill as a trade-company search tool, but the instructions also authorize account lifecycle and billing actions such as requesting API keys, creating recharge orders, retrieving account/pricing information, error reporting, and local version caching. This mismatch is dangerous because users may consent to data lookup functionality without understanding that the skill can initiate side-effecting account and payment-related operations or store artifacts locally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs callers to send request parameters, response payloads, and exception context to an external error-reporting endpoint, but it does not require user notice, consent, data minimization, or strict guidance on excluding secrets and personal data. Although it mentions that sensitive fields will be automatically masked, that control is undefined and may be incomplete, creating a real risk of unintended disclosure of business data, personal data, tokens, stack traces, or other sensitive content during failure handling.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script automatically stores a newly issued API key in a local .env file without explicit prior consent, permission hardening, or secure storage controls. On multi-user systems or misconfigured environments, this can expose long-lived credentials to other local users, backups, or accidental inclusion in logs and repositories.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script forwards a caller-supplied context field to a remote error-report endpoint without any visible minimization, redaction, or disclosure. If request context contains prompts, identifiers, business data, or user-provided content, operational failures could cause unintended transmission of sensitive information to the platform.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs the agent to inspect `~/.upkuajing/.env` for an API key and to automatically save newly issued credentials there. Accessing and managing secrets in a local dotenv file is sensitive because it expands the skill from search into credential discovery and persistence, increasing the chance of secret exposure, misuse, or overwrite if the agent environment is shared or insufficiently isolated.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 94% confidence
• Finding: The skill goes beyond checking for an existing key and offers to request a new API key and automatically write it into `~/.upkuajing/.env`. Automatic credential provisioning and local persistence are high-risk behaviors because they create, store, and potentially expose authentication material on disk, and they are not central to the advertised search-only purpose.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: Writing an API key in plaintext to a .env file creates credential exposure risk if file permissions are weak, the home directory is shared, or the file is later committed, backed up, or inspected by other software. This is more sensitive in this skill because the credential grants access to paid account functionality and trade-data services.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: The dependency is specified with a lower-bound only (httpx>=0.23.0), which allows installation of any newer release, including breaking or vulnerable versions introduced later. This weakens build reproducibility and increases supply-chain risk because different environments may resolve to different package versions over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196