Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent paid UpKuaJing LinkedIn alumni lookup skill, with disclosed account and billing flows, but users should pay attention to API-key storage, fees, personal-data use, and update-check behavior.
Install only if you are comfortable using UpKuaJing as the data provider, paying for API calls after confirmation, and storing the provider API key in a plaintext file under your home directory. Review privacy and compliance obligations before querying LinkedIn-derived personal data, and avoid including raw personal data or secrets in error reports.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")httpx>=0.23.0
pass # 如果读取失败，继续执行
# 不需要认证申请新密钥
response = make_request('/agent/auth/create', {}, require_auth=False)
# 检查是否申请成功
if response.get('code') != 0:pass # 如果读取失败，继续执行
# 不需要认证申请新密钥
response = make_request('/agent/auth/create', {}, require_auth=False)
# 检查是否申请成功
if response.get('code') != 0:Detected: suspicious.exposed_secret_literal