xianyu-ops
闲鱼（goofish.com）商品搜索、查看详情、私信会话管理与回复。通过 forked camoufox-cli 挌久化 session xianyu 完成。当用户要求在闲鱼上搜索商品、查看宝贝、读取或回复私信时触发。
78
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md 指定运行的 `scripts/xianyu_search.py` 会在 camoufox headful 中对外部网页 `https://www.goofish.com/search?...` 调用 `camoufox-cli --json open/eval`，把 goofish 页面加载与 mtop 接口返回的内容解析后作为 JSON 输出进入后续代理上下文（间接提示注入风险：外部网页/接口响应被当作可读文本读入）。
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill opens goofish pages and calls in-page JS (window.lib.mtop.request) at runtime (e.g. https://www.goofish.com/search?q={关键词}), so it executes/relies on remote page code from https://www.goofish.com during runtime.
- Repository
- TeamWiseFlow/xiaobei
- Commit
bcef823
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.