Global customs trade data aggregated across 220+ countries with integrated bulk search functionality for global B2B prospecting. Accelerate discovery ofverified genuine buyers and qualified international suppliers for export businesses. Dig into official import & export shipment records to pinpointproduct-matching importers and full historical transaction logs. Run targeted lookups filtered by company profiles, HS codes and product keywords. Trade teamsleverage verified real-world shipment intelligence to secure high-value B2B prospects and track competitors’ cross-border trading activity.

• Outcome: Review
• Latest audit: Oct 14, 2026 · 7:04 AM UTC
• Version: 1.0.11

Overview

The skill matches its customs-trade search purpose, but it needs review because it stores and exposes a plaintext API key and can perform paid account API calls without code-enforced confirmation.

Review before installing if you are comfortable giving this skill access to an UpKuaJing API key and prepaid balance. Avoid printing ~/.upkuajing/.env, restrict that file to your user account, and require a fresh explicit confirmation before any paid search, enrichment, contact lookup, or top-up action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/company_list_search.py:27

Finding

Billable API operations do not enforce explicit user confirmation

Content

View full analysis

Vulnerability Details

File Location: scripts/company_list_search.py:27-33, 109-114; equivalent billable request paths exist in scripts/trade_list_search.py:27-33, 104-109, scripts/company_get_contact.py:16-24, 42-49, and scripts/company_get_details.py:16-22, 40-47
Vulnerability Type: Missing authorization gate for fee-incurring operations
Risk Level: Medium

Complete Code Snippets

scripts/company_list_search.py:27-33:

python

request_params = params.copy()
if cursor:
    request_params['cursor'] = cursor
# 不传 cursor 表示首次请求

# 发起API请求
response = make_request('/agent/customs/company/list', request_params)

scripts/company_list_search.py:109-114:

python

while total_retrieved < args.query_count:
    try:
        # 搜索当前批次
        response = search_company_list(params, current_cursor)

scripts/trade_list_search.py:27-33:

python

request_params = params.copy()
if cursor:
    request_params['cursor'] = cursor
# 不传 cursor 表示首次请求

# 发起API请求
response = make_request('/agent/customs/trade/list', request_params)

scripts/company_get_contact.py:16-24:

python

params = {
    'companyIds': company_ids
}
response = make_request('/agent/customs/company/contact/batch', params)
return response

scripts/company_get_details.py:16-22:

python

params = {'companyIds': company_ids}
response = make_request('/agent/customs/company/detail/batch', params)
return response

Technical Analysis

SKILL.md:120-128 establishes an authorization boundary requiring the Skill to inform the user about fees and wait for explicit confirmation in a separate message before performing any fee-incurring operation. The executable scripts do not enforce that boundary.

The search entry points immediately issue authenticated API requests and may repeat them in a loop until query_count records have been requested. The contact and detail entry po ...[truncated 1857 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a mandatory confirmation mechanism to every billable executable path, such as --confirm-fee, and reject execution when it is absent.
2. Bind confirmation to the exact operation, requested record or ID count, expected number of API calls, current pricing, and a short expiration period. A generic reusable flag should not authorize unrelated future requests.
3. Implement a dry-run mode that calculates and displays the expected call count and fee before any authenticated request is sent.
4. Require fresh confirmation before continuation calls using --task_id, additional cursor batches, or any change to the original parameters.
5. Apply the same enforcement to company contact and detail requests, including single-ID requests if all API calls incur fees as documented.
6. Enforce a configurable maximum charge or call count per confirmed operation and stop when the approved limit is reached.
7. Keep the documentation-level confirmation instructions, but treat them as supplementary guidance rather than the sole authorization control.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented behavior includes remote version checks and local cache storage in ~/.upkuajing/version_cache.json, which are ancillary capabilities not reflected in the advertised customs-search purpose. While less severe than credential or payment actions, undisclosed update checks and local caching still expand network and filesystem exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior includes remote version checks and local cache storage in ~/.upkuajing/version_cache.json, which are ancillary capabilities not reflected in the advertised customs-search purpose. While less severe than credential or payment actions, undisclosed update checks and local caching still expand network and filesystem exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented behavior includes remote version checks and local cache storage in ~/.upkuajing/version_cache.json, which are ancillary capabilities not reflected in the advertised customs-search purpose. While less severe than credential or payment actions, undisclosed update checks and local caching still expand network and filesystem exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented behavior includes remote version checks and local cache storage in ~/.upkuajing/version_cache.json, which are ancillary capabilities not reflected in the advertised customs-search purpose. While less severe than credential or payment actions, undisclosed update checks and local caching still expand network and filesystem exposure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The documentation instructs reading the entire ~/.upkuajing/.env file with cat, which risks exposing the API key and any other secrets in that file to the agent, logs, or user-visible output. In this context, the skill is explicitly handling credentials, so encouraging raw secret-file display is a direct credential-exposure hazard.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The flow asks the user to manually add a provided API key into ~/.upkuajing/.env, which encourages handling secrets in plain text and increases the chance of accidental disclosure through shell history, editor backups, or insecure file permissions. The same flow also normalizes local secret persistence without discussing secure storage practices.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Automatically saving a newly created API key to ~/.upkuajing/.env creates a credential at rest on disk without any documented permission checks, encryption, or minimization. In a multi-user or poorly secured environment, that can expose the key to other local processes or users and broaden compromise from one session to the underlying account.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The script writes a newly issued API key directly to a plaintext .env file under a user directory. If that file has permissive filesystem permissions, is backed up to insecure locations, or is accidentally included in tooling or support bundles, the credential can be stolen and abused to access paid APIs or account-linked functions.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly relies on environment variables, local file reads/writes under ~/.upkuajing, and networked API calls, but it declares no tool scope or permissions boundaries. That creates an avoidable trust gap: users and the hosting agent cannot easily constrain what the skill may access, increasing the chance of over-broad file, credential, or network access during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate on generic business-search requests, increasing the likelihood the skill runs in contexts broader than intended. Over-broad invocation expands exposure to file, credential, and network actions for users who did not specifically ask for this vendor integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill offers retrieval of company contact details including email, phone, social media, and website without a clear privacy warning or usage guardrails. In context, this makes the skill more dangerous because it supports direct acquisition of potentially sensitive contact data at scale for prospecting or monitoring workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The note states that product names and industry names must be in English, which is a language constraint expressed in natural language. The file does not present this as an optional limitation, offer translation handling, or justify the locale restriction as a documented region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The API reference explicitly supports filtering companies by the existence of phone numbers, email addresses, WhatsApp, websites, and social accounts, which indicates handling of contact-related business data without any privacy, consent, retention, or acceptable-use guidance. In the context of a trade-intelligence skill designed to find overseas buyers and monitor competitors, this materially increases the risk of misuse for unsolicited outreach, profiling, or bulk lead harvesting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly instructs agents to send request parameters, response data, and error context to an external reporting endpoint. Although it notes that sensitive fields are 'automatically desensitized,' it provides no explicit user notice, consent requirement, data-minimization guidance, or restriction against including confidential business data, which creates a real privacy and data-leakage risk if agents forward raw trade queries, identifiers, or stack traces.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for searching global customs trade data, import/export records, HS codes, buyers, and competitors. This file's documented purpose and implemented commands include API key issuance, account balance retrieval, recharge order creation, and pricing lookup, which are account/billing management functions rather than trade-data search behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring presents the skill purpose entirely in Chinese, and the CLI help/messages throughout the file follow the same pattern. Under the policy for natural-language violations, forcing a specific language without user opt-in can exclude users and constitutes a locale/language policy issue unless clearly justified.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0: