Security audit
Security checks across malware telemetry and agentic risk
This skill mostly matches a paid LinkedIn education lookup service, but it also handles plaintext API keys, account billing actions, and persistent local files in ways users should review carefully.
Install only if you are comfortable with a paid third-party service that queries LinkedIn-derived personal education data, stores an API key in a plaintext home-directory file, and can create account top-up orders. Use it with explicit user confirmation for paid calls, avoid shared machines, protect or delete ~/.upkuajing/.env when done, and ensure you have a lawful and authorized basis for any profile lookup.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
env_file = UPKUAJING_ENV_FILE
if env_file.exists():
# 读取现有的 .env 文件
try:
with open(env_file, 'r', encoding='utf-8') as f:
content = f.read()"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关
def load_env_file() -> Dict[str, str]:
"""
从 ~/.upkuajing/.env 文件加载环境变量。
Returns:
环境变量字典def get_api_key() -> str:
"""
获取API密钥，优先从环境变量，其次从 ~/.upkuajing/.env 文件。
"""
# 优先从环境变量获取
api_key = os.environ.get(API_KEY_ENV)# 优先从环境变量获取
api_key = os.environ.get(API_KEY_ENV)
# 如果环境变量没有，尝试从 ~/.upkuajing/.env 读取
if not api_key:
env_vars = load_env_file()
api_key = env_vars.get(API_KEY_ENV)httpx>=0.23.0
65/65 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal