game-market

PassAudited by ClawScan on May 6, 2026.

Overview

This skill transparently queries YY marketplace listings and can open the YY website after confirmation, with no evidence of automatic purchases, credential theft, persistence, or data destruction.

Before installing, be aware that the skill will run listing-query code and send game/category searches to YY's marketplace API. It appears scoped to browsing listings and opening the official YY website after confirmation; any actual buying, selling, login, or payment should be reviewed and completed manually by you.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

Using the skill may run Python in the agent environment and send the selected game/category query to YY's marketplace API.

Why it was flagged

The skill's normal operation relies on executing inline Python that makes external HTTPS requests. This is disclosed and central to querying listings, but it is still local code execution.

Skill content

Run this Python snippet ... resp = requests.get(BASE + uri, params=params, headers=sign(uri), timeout=15)

Recommendation

Use it only in an environment where running simple network-query snippets is acceptable, and avoid entering unrelated sensitive information into marketplace searches.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill does not require your YY login, but its requests are made using embedded marketplace signing values rather than a user-provided credential.

Why it was flagged

The skill embeds signing material for YY marketplace API requests. It is not a user credential and is disclosed as a front-end signature, but it represents delegated API identity for the marketplace query flow.

Skill content

APPID  = "market_app"
SECRET = "ixlOJVDwdOm5rGdudhEywwK6"
HDID   = "38e6a82f5f724517d6cbe82cde56e846690afcb0"

Recommendation

Treat the skill as using YY's public/front-end API behavior; do not add personal account tokens or cookies unless the skill is updated to clearly scope and protect them.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Confirming the prompt may open an external marketplace page where you could choose to log in, buy, or sell outside the chat.

Why it was flagged

The buy/sell flow can launch a browser to the YY marketplace. The artifacts require user confirmation and do not instruct the agent to complete purchases or sales.

Skill content

If user confirms, run:

open "https://mall.yy.com/?pageId=20000"

Recommendation

Confirm only when you intend to visit YY, verify the URL and item details yourself, and complete any transaction manually on the website.