UpKuaJing Company and People Search
v1.0.4Official skill for upkuajing (跨境魔方). Find companies (找公司) and global people (找人) data. Get business registration, background info, and contact details (Email...
⭐ 13· 136·0 current·0 all-time
by@warmc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the code and docs: scripts call https://openapi.upkuajing.com for company/person lists, details, and contacts. Requested binary (python) and primary env var (UPKUAJING_API_KEY) are appropriate for this purpose. The skill reads/writes ~/.upkuajing for the API key and stores task data under the skill's task_data directory, which is coherent with its stated workflow.
Instruction Scope
SKILL.md instructs the agent to install dependencies, run the included Python scripts, and to inform/wait for explicit user confirmation before executing operations that incur fees. The code implements API calls and local persistence (API key file, optional logs, task result files). Enforcement of 'wait for explicit user confirmation' is a policy in the SKILL.md rather than a runtime-enforced guard in every script, so correct behavior depends on the invoking agent following the instructions.
Install Mechanism
No automated install spec is present (instruction-only install). The README instructs running pip install -r requirements.txt (requirements contain httpx only). No downloads from unknown hosts or archive extraction are present in the bundle.
Credentials
Only UPKUAJING_API_KEY is required and declared as primary credential. The code reads this from the environment or from ~/.upkuajing/.env and may write a new key there when creating a key. That file location and the API key requirement are proportional to the skill’s advertised functionality. No unrelated secrets or cross-service credentials are requested.
Persistence & Privilege
The skill does not request global or always-present privileges (always:false). It writes only to its own config location (~/.upkuajing), optional logs there (logging is disabled by default), and to task_data under the skill directory. It does not modify other skills or system-wide agent config.
Assessment
This skill appears coherent with its description. Before installing, consider: 1) Network & billing: the scripts will call openapi.upkuajing.com and every API call is billable — ensure you understand pricing and the SKILL.md requirement to ask for explicit confirmation before running queries that incur charges. 2) API key storage: the skill will save/read UPKUAJING_API_KEY in ~/.upkuajing/.env if you use the provided auth helper — treat that file like a secret. 3) Logs & data: request/response logging is implemented but disabled by default; if you enable logging you may store request/response data locally. 4) Autonomous runs: the skill can be invoked by an agent automatically (platform default); if you are worried about accidental charges or large data collection, ensure your agent's policy requires user confirmation before invoking this skill or run the scripts manually. 5) Legality/privacy: the skill returns contact and personal data — make sure your use complies with local privacy laws and acceptable use policies. If you want higher assurance, review the contained scripts yourself or run them in an isolated environment and verify where files are written before supplying your API key.Like a lobster shell, security has layers — review code before you run it.
latestvk97dq3fnz6vax0ddfth7nywc5183x9y8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🏢 Clawdis
Binspython
EnvUPKUAJING_API_KEY
Primary envUPKUAJING_API_KEY