Security audit
Security checks across malware telemetry and agentic risk
This skill can query a paid customs-data API, but it also handles API keys, account billing actions, and automatic version checks that users should review before installing.
Install only if you are comfortable letting the skill contact UpKuaJing, use or create an UPKUAJING_API_KEY, store that key in a plaintext ~/.upkuajing/.env file, check account balances, create top-up payment URLs, and perform a daily provider version check. Confirm any paid query or top-up action before proceeding, and consider managing the API key through your own secret-storage process instead of the skill-created .env file.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
env_file = UPKUAJING_ENV_FILE
if env_file.exists():
# 读取现有的 .env 文件
try:
with open(env_file, 'r', encoding='utf-8') as f:
content = f.read()"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")except IOError as e:
return {
"success": False,
"message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
"envFilePath": str(env_file)
}httpx>=0.23.0
VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal