Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its stated purpose, but it needs review because it handles paid employee-data lookups while storing API keys in plaintext and performing some under-disclosed network/persistence behavior.
Review before installing if you are comfortable with a paid third-party employee-data service storing its API key in ~/.upkuajing/.env and contacting UpKuaJing during use. Avoid printing the .env file, confirm fees before each query, and do not submit raw personal, business-sensitive, or secret data in error reports.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"""
申请新的 API 密钥。
"""
# 检查是否已存在 .env 文件和 API key
env_file = UPKUAJING_ENV_FILE
if env_file.exists():env_file = UPKUAJING_ENV_FILE
if env_file.exists():
# 读取现有的 .env 文件
try:
with open(env_file, 'r', encoding='utf-8') as f:
content = f.read()"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")httpx>=0.23.0
VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal