ClawHub

UpKuaJing map merchants search, Discover local businesses, retail stores, and verified sellers via global map data. UpKuaJing helps field sales, distributors, and brand teams find geo-targeted merchants, analyze regional markets, and generate offline-to-online (O2O) leads — perfect for territory expansion, agent sourcing, and competitor location intelligence.

v1.0.1

Official skill for upkuajing (跨境魔方). Search merchants on map (地图获客). Find merchants by region or nearby location, get merchant details including name, addres...

⭐ 0· 91·0 current·0 all-time
by@upkuajing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the included Python scripts and API endpoints. Required binary (python) and required env var (UPKUAJING_API_KEY) are appropriate and expected for a client of the UpKuaJing Open Platform.
ℹ
Instruction Scope
SKILL.md instructs installing dependencies and running the provided scripts and documents billing constraints (must inform and wait for explicit confirmation when query_count > 100). The scripts themselves read/write ~/.upkuajing/.env (API key), write task results under a task_data directory, and may write logs to ~/.upkuajing/logs if logging is enabled. The SKILL.md requires user confirmation for large queries, but there is no programmatic enforcement of that confirmation in the scripts — the agent or user must follow the documented confirmation rule to avoid unexpected billing.
✓
Install Mechanism
Instruction-only skill with Python scripts and a small requirements.txt (httpx). No remote installers, no downloads from untrusted URLs, and nothing writes executable code to system locations beyond normal script usage.
✓
Credentials
Only one credential is requested (UPKUAJING_API_KEY), which is the expected credential for this API. The code uses that key for Authorization and also documents an optional ~/.upkuajing/.env fallback. No unrelated secrets or config paths are requested.
✓
Persistence & Privilege
Skill does not request always:true or any elevated platform privileges. It persists data only within its user-scoped ~/.upkuajing/ directory and a local task_data directory; this is consistent with its function (storing API key, logs, task results).
Assessment
This package appears coherent with its stated purpose, but review these points before installing: 1) Protect your UPKUAJING_API_KEY — it will be stored in ~/.upkuajing/.env if you use the provided 'new_key' flow. 2) The service charges per API call; SKILL.md requires explicit user confirmation for query_count > 100 but the scripts don't automatically enforce an interactive confirmation — ensure the agent or the person running it asks you first to avoid unexpected billing. 3) If you enable ENABLE_API_LOGGING, request/response data (including returned merchant details) will be written to ~/.upkuajing/logs; only enable if you accept that storage. 4) auth.py may open or return payment URLs for top-ups — only use trusted payment pages and verify the developer site. 5) If you want stronger safety, inspect or run the scripts locally in a sandbox and confirm that the API_BASE_URL (https://openapi.upkuajing.com) and endpoints are legitimate before supplying credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk970jq08qr6aspm16a75xmbrbn84k0x8

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📍 Clawdis
Binspython
EnvUPKUAJING_API_KEY
Primary envUPKUAJING_API_KEY

Comments