critical
suspicious.dangerous_exec
- Location
- grabber-enhanced.js:196
- Finding
- Shell command execution detected (child_process).
闲鱼数据抓取
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
Using the skill may violate platform anti-bot rules, risk account restrictions, and cause the agent to perform stealth scraping rather than ordinary browsing.
Why it was flagged
The browser automation deliberately masks Playwright automation signals; this matches the skill's stated goal of bypassing anti-crawler protections.
Skill content
'--disable-blink-features=AutomationControlled', ... Object.defineProperty(navigator, 'webdriver', { get: () => undefined });Recommendation
Only use this if you understand the platform and account risks; remove stealth/anti-detection behavior or require explicit user confirmation before scraping.
What this means
A crafted keyword or config value could cause arbitrary shell commands to run in the OpenClaw workspace.
Why it was flagged
The keyword can come from command-line/user input and becomes part of a path interpolated into a shell command, so shell metacharacters in a keyword could execute unintended commands.
Skill content
const screenshotPath = path.join(screenshotDir, `xianyu-${keyword}.png`); ... execSync(`python3 ${pythonScript} "${item.screenshot}"`, ...)Recommendation
Replace execSync shell strings with spawn/execFile argument arrays, validate filenames, and avoid passing user-derived paths through a shell.
What this means
If misused or exposed, these credentials could allow repository changes or access to the user's logged-in Xianyu session.
Why it was flagged
The skill requests a Gitee token with repository project permissions and a Xianyu login cookie, both of which can grant meaningful account access.
Skill content
- GITEE_TOKEN: Gitee 个人访问令牌 ... - XIANFU_COOKIE: 闲鱼登录 Cookie（可选，提高成功率） ... 创建新令牌（勾选 `projects` 权限）
Recommendation
Use a dedicated low-privilege Gitee token, a private throwaway repository, and avoid providing a personal Xianyu session cookie unless necessary.
Concern
ASI10: Rogue AgentsWhat this means
The skill can continue scraping and processing data in the background after installation, even when the user is not actively invoking it.
Why it was flagged
The installer automatically appends scheduled jobs to the user's crontab, including recurring scrape/report/cleanup tasks.
Skill content
(crontab -l 2>/dev/null || true; cat "$CRON_FILE") | crontab -
Recommendation
Make cron installation explicitly opt-in, show the exact jobs before installing them, and provide a reliable disable/uninstall command.
What this means
A changed or malicious remote installer could run arbitrary setup commands in the user's environment.
Why it was flagged
The documentation recommends executing an unpinned remote script directly through bash, with an unknown source and no checksum or review step.
Skill content
curl -sL https://raw.githubusercontent.com/your-username/xianyu-data-grabber/main/install.sh | bash
Recommendation
Avoid curl-pipe-bash installation; install only from reviewed local files or pin the source to an immutable commit with checksum verification.
What this means
Users may underestimate that generated data and screenshots can leave their machine and be stored in a Gitee repository.
Why it was flagged
The privacy text says data files are local and not uploaded to third parties, while the same skill repeatedly describes automatic upload to Gitee.
Skill content
自动上传到 Gitee 仓库 ... 数据文件: 本地存储，不上传第三方
Recommendation
Clearly state that Gitee is an external service, make upload disabled by default, and require explicit user approval before uploading.
Findings (3)
critical
suspicious.dangerous_exec
- Location
- grabber.js:163
- Finding
- Shell command execution detected (child_process).
warn
suspicious.destructive_delete_command
- Location
- INSTALL.md:149
- Finding
- Documentation contains a destructive delete command without an explicit confirmation gate.