Security audit
Security checks across malware telemetry and agentic risk
This paid trade-data skill is not clearly malicious, but it handles API keys and top-up orders beyond a simple read-only query and stores secrets in a plaintext local file.
Install only if you trust UpKuaJing and are comfortable with the agent reading and writing `~/.upkuajing/.env`, sending your API key to the UpKuaJing API, and helping create payment/top-up orders. Prefer setting the API key through a managed secret mechanism or a tightly permissioned file, and require a separate explicit confirmation before any billed query or top-up action.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")except IOError as e:
return {
"success": False,
"message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
"envFilePath": str(env_file)
}httpx>=0.23.0
VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal