ClawHub
Back to skill

Security audit

提供谷歌地图线下商户数据批量查询、下载，实现批量搜索，支持按国家、省、市、区域、地域、半径、行业、产品关键词等条件筛选，批量获取商家名称、地址、联系方式等信息，精准挖掘海外采购商，本地推广，提升客户开发效率。帮助地推销售、经销商、品牌团队、区域经理按地理位置、商圈定位商家、分析区域市场密度与覆盖范围、适合区域扩张开店、代理商/经销商寻源、竞品门店点位情报与选址分析，适用于地推获客、线下渠道招帮助地推销售、经销商、品牌团队、区域经理按地理位置、商圈定位商家、分析区域市场密度与覆盖范围、生成销售线索——适合区域扩张开店、代理商/经销商寻源、竞品门店点位情报与选址分析，适用于地推获客、线下渠道招商与门店网络规划。

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed paid merchant-search integration with some ordinary API-key, billing, network, and local-result handling that users should understand before use.

Install only if you are comfortable giving this skill access to an UPKUAJING API key, making paid API calls after confirmation, creating recharge orders when balance is insufficient, and storing API keys/results in local files. Review charges before large searches and protect ~/.upkuajing/.env like any other credential file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes capabilities beyond a simple documented search workflow: it reads environment secrets, writes local files, and performs network actions, yet does not declare permissions explicitly. This reduces transparency and informed consent, making it easier for a user or host agent to trigger sensitive operations like credential access, persistence of results, or remote calls without clear permission boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The declared purpose is merchant discovery, but the documented behavior also includes account inspection, price lookup, version checking, local secret handling, billing workflows, and persistence of task data. That mismatch is security-relevant because users may authorize a benign-seeming data lookup skill without realizing it can interact with billing/account state and store artifacts locally.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The file implements authentication, API key issuance, account balance lookup, and recharge capabilities even though the declared skill purpose is merchant search. This scope expansion increases the attack surface and enables financial/account operations that users may not expect from a data-search skill, making abuse or user confusion more likely.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code can create recharge/payment orders through /agent/auth/pay/url, which is unrelated to the stated merchant-search use case. Introducing payment flows in an unexpected context can enable unauthorized billing actions, social engineering, or hidden monetization paths if invoked by an agent or user without clear consent.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The code performs an outbound HTTP request to a server endpoint and sends the skill name as metadata without any explicit user notice or consent mechanism. While the transmitted data is limited and the feature is framed as version checking, this still creates an undisclosed telemetry channel and may surprise users in restricted or privacy-sensitive environments.

Credential Access

High
Category
Privilege Escalation
Content
### **API密钥未设置**
首先检查 `~/.upkuajing/.env` 文件中是否有 UPKUAJING_API_KEY；
如果 UPKUAJING_API_KEY 未设置，提示用户选择：
1. 用户已有密钥：用户自行添加（手动添加到 ~/.upkuajing/.env 文件）
2. 用户没有密钥：引导用户前往 [跨境魔方开放平台](https://developer.upkuajing.com/) 申请
等待用户选择；
Confidence
90% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")
Confidence
88% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.23.0
Confidence
93% confidence
Finding
httpx>=0.23.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:197