Security audit
Security checks across malware telemetry and agentic risk
This paid trade-data skill is not clearly malicious, but it bundles sensitive account, billing, credential storage, and hidden version-check behavior that users should review before installing.
Install only if you are comfortable giving the skill access to an UpKuaJing API key, letting it store that key in a plaintext home-directory file, and using its account and top-up helper commands. Confirm any paid query or recharge action separately, avoid sharing the .env contents in chat or logs, and consider managing the API key yourself rather than letting the skill create and persist one.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")httpx>=0.23.0
64/64 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal