Security audit
Security checks across malware telemetry and agentic risk
This is a paid UpKuaJing colleague-lookup skill with disclosed API-key, billing, and local credential behavior, but users should treat it as a sensitive paid people-data tool.
Install only if you are comfortable using a paid people-data API. Confirm every fee-incurring query, protect the UPKUAJING_API_KEY stored in ~/.upkuajing/.env, avoid sharing outputs that contain sensitive personal or business data, and use the top-up workflow only when you intentionally want to create a payment order.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")httpx>=0.23.0
65/65 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal