中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:2 days ago Rescan
5 /100
upkuajing-company-people-search
Official skill for upkuajing (跨境魔方). Find companies and global people data through API.
This is a legitimate business API wrapper skill for company and people data search. All capabilities are declared in SKILL.md and the code implements straightforward API calls without any malicious behavior.
Skill Nameupkuajing-company-people-search
Duration31.3s
Enginepi
✓
Safe to install
This skill is safe to use. No additional security controls are required.
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned scripts/common.py:52 - Creates ~/.upkuajing/ directory and .env file for API key…
Network READ READ ✓ Aligned scripts/common.py:16 - Makes POST requests to https://openapi.upkuajing.com (dec…
Environment READ READ ✓ Aligned scripts/common.py:44 - Reads UPKUAJING_API_KEY from environment or ~/.upkuajing/…
Shell NONE NONE — No subprocess or shell execution found in any script
4 findings
🔗
Medium External URL 外部 URL
https://www.upkuajing.com
SKILL.md:4
🔗
Medium External URL 外部 URL
https://developer.upkuajing.com/
SKILL.md:88
🔗
Medium External URL 外部 URL
https://www.upkuajing.com/web/openapi/price.html
SKILL.md:93
🔗
Medium External URL 外部 URL
https://openapi.upkuajing.com
scripts/common.py:16

File Tree

14 files · 56.2 KB · 1781 lines
Python 7f · 1237L Markdown 6f · 543L Text 1f · 1L
├─ ▾ 📁 references
│ ├─ 📝 company-detail-api.md Markdown 43L · 1.3 KB
│ ├─ 📝 company-list-api.md Markdown 101L · 3.7 KB
│ ├─ 📝 contact-api.md Markdown 37L · 1.4 KB
│ ├─ 📝 human-detail-api.md Markdown 47L · 1.3 KB
│ └─ 📝 human-list-api.md Markdown 109L · 3.9 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 auth.py Python 177L · 5.2 KB
│ ├─ 🐍 common.py Python 494L · 14.1 KB
│ ├─ 🐍 company_details.py Python 56L · 1.3 KB
│ ├─ 🐍 company_list_search.py Python 193L · 5.9 KB
│ ├─ 🐍 get_contact.py Python 68L · 1.7 KB
│ ├─ 🐍 human_details.py Python 57L · 1.3 KB
│ └─ 🐍 human_list_search.py Python 192L · 5.9 KB
├─ 📄 requirements.txt Text 1L · 14 B
└─ 📝 SKILL.md Markdown 206L · 9.2 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
httpx >=0.23.0 pip No Modern, secure HTTP client library

Security Positives

✓ No shell execution (subprocess) found in any script
✓ No credential harvesting - only handles its own declared API key
✓ No data exfiltration - all network traffic goes to declared API endpoint https://openapi.upkuajing.com
✓ No base64-encoded payloads or obfuscated code
✓ No attempts to access sensitive paths (~/.ssh, ~/.aws, .env files other than its own)
✓ No eval(), exec(), or other dangerous functions
✓ API logging disabled by default (ENABLE_API_LOGGING = False)
✓ Path traversal protection implemented (UUID validation in get_task_dir)
✓ Clean, well-documented code with clear purpose