Security audit
Security checks across malware telemetry and agentic risk
This is a paid UpKuaJing LinkedIn work-history lookup skill with disclosed API key, pricing, and top-up helpers, but users should understand the plaintext key storage and paid API behavior before installing.
Install only if you are comfortable sending person IDs to UpKuaJing's paid API and storing the API key in ~/.upkuajing/.env. Review fee prompts carefully, do not let an agent run billable queries without your explicit approval, and protect or remove the local .env file when no longer needed.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")httpx>=0.23.0
65/65 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal