Security audit
Security checks across malware telemetry and agentic risk
This is a disclosed paid SMS provider skill; it handles sensitive SMS, contact, credential, and billing data, but the artifacts do not show deception or unrelated access.
Install only if you trust UpKuaJing with recipient phone numbers, SMS message bodies, delivery records, billing activity, and the UPKUAJING_API_KEY. Prefer setting the API key through your environment or a managed secrets store instead of plaintext ~/.upkuajing/.env, review any SMS send or top-up prompt carefully, and expect normal use to contact openapi.upkuajing.com and keep a small local version cache.
### **API Key Not Set** First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the API (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection;
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose: 1. User has one: User provides it (manually add to ~/.upkuajing/.env file) 2. User doesn't have one: You can apply using the API (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env Wait for user selection; ### **Account Top-up**
"envFilePath": str(env_file)
}
# 保存到 .env 文件
try:
with open(env_file, 'w', encoding='utf-8') as f:
f.write(f"{API_KEY_ENV}={api_key}\n")67/67 vendors flagged this skill as clean.
No suspicious patterns detected.