UpKuaJing Company and People Search
Analysis
The skill is coherent with its stated UpKuaJing company/people search purpose, but users should notice that it uses an API key, can spend account balance, and stores some results locally.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
**All API calls incur fees** ... **Any operation that incurs fees must first inform and wait for explicit user confirmation. Do not execute in the same message as the notification.**
The skill can perform paid API calls, but the artifact also instructs the agent to stop and obtain explicit confirmation before fee-incurring operations.
Description: Official skill for upkuajing ... Source: unknown; Homepage: none
The registry metadata presents an official-skill claim while also showing unknown source and no registry homepage, so users should verify provenance before trusting payment or credential flows.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
API_KEY_ENV = "UPKUAJING_API_KEY" ... UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' ... headers["Authorization"] = f"Bearer {api_key}"The scripts read a service API key from the environment or local ~/.upkuajing/.env file and use it as a bearer credential for UpKuaJing API calls.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
append_result_data(task_id, company_list) ... 'file_url': get_task_result_file(task_id)
List-search results are appended to task result files and returned by file path, creating persistent local copies of retrieved business/person search data.