Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real paid customs-data query skill, but it also manages local API keys and can create recharge payment orders, so it needs user review before installation.
Install only if you are comfortable with the skill using an UpKuaJing API key, storing it in ~/.upkuajing/.env, making paid API calls after confirmation, and creating a top-up payment URL if the account balance is insufficient. Treat the API key like a password and review any top-up prompt before proceeding.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"""
申请新的 API 密钥。
"""
# 检查是否已存在 .env 文件和 API key
env_file = UPKUAJING_ENV_FILE
if env_file.exists():env_file = UPKUAJING_ENV_FILE
if env_file.exists():
# 读取现有的 .env 文件
try:
with open(env_file, 'r', encoding='utf-8') as f:
content = f.read()"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")httpx>=0.23.0
VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal