Global customs trade data aggregated across 220+ countries with integrated bulk search functionality for global B2B prospecting. Accelerate discovery ofverified genuine buyers and qualified international suppliers for export businesses. Dig into official import & export shipment records to pinpointproduct-matching importers and full historical transaction logs. Run targeted lookups filtered by company profiles, HS codes and product keywords. Trade teamsleverage verified real-world shipment intelligence to secure high-value B2B prospects and track competitors’ cross-border trading activity.

• Outcome: Review
• Latest audit: Jul 17, 2026 · 12:36 AM UTC
• Version: 1.0.9

Overview

This is a disclosed paid UpKuaJing trade-data client; the main risks are local API-key storage, paid API calls, and company contact-data retrieval, with no hidden destructive or exfiltration behavior found.

Install only if you are comfortable giving the skill an UpKuaJing API key, making paid API calls after confirmation, and receiving company contact information that may be subject to privacy or outreach rules. Protect ~/.upkuajing/.env as a secret file and review fee prompts before allowing searches or enrichment calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit permissions even though its documented behavior requires environment variable access, reading and writing files under the user's home directory, and network/API communication. This mismatch weakens user understanding and platform enforcement, making it easier for a skill with sensitive capabilities to run without clear consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documented API retrieves direct contact information including emails, phone numbers, WhatsApp indicators, social profiles, and website sensitivity metadata, which goes beyond the skill’s declared purpose of customs trade search and competitor monitoring. This capability increases privacy, compliance, and misuse risk because it enables enrichment of trade records into actionable outreach targets without clear scope limitation or user-consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file implements API-key issuance, account lookup, pricing, and recharge workflows, which materially exceed the skill's declared trade-data search purpose. Scope expansion is security-relevant because it introduces billing and credential-management capabilities that can be abused or triggered unexpectedly, especially if users or orchestrators expect read-only lookup behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Creating recharge orders is a financial operation unrelated to simple customs-trade searching, so embedding it in this skill broadens the attack surface from data retrieval to payment initiation. If exposed through an agent workflow, it could cause unauthorized or surprising billing actions by users who did not intend to enter a payment flow.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: This module introduces outbound network communication to a version-check API and persistent local caching under the user's home directory, behavior that is not necessary for the core trade-data search function described for the skill. While likely intended for update notification, it expands the skill's attack surface, creates an unexpected telemetry path, and could expose environment or usage metadata if the remote endpoint or base URL handling is not tightly controlled.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are very broad and overlap with ordinary business research requests, so the skill could be invoked in contexts the user did not specifically intend. Because the skill can access paid APIs, local credential files, and contact data, accidental invocation increases both privacy and financial risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises retrieval of email, phone, social media, and website data without any privacy warning, usage constraints, or consent guidance. That omission can normalize collection of personal or quasi-personal contact data and encourage misuse for scraping, profiling, or unsolicited outreach.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 72% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 96% confidence
• Finding: httpx>=0.23.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:88