Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

闲鱼自动发布工具

v1.0.0

闲鱼自动化发布工具 - 帮助用户在闲鱼平台自动发布商品。 支持:商品信息填写、图片上传、价格设置、批量发布。 使用场景:(1) 批量上架商品到闲鱼 (2) 自动发布闲置物品 (3) 定时发布营销内容 触发词:发布闲鱼、上架商品、闲鱼发布、自动上架

0· 268·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for onlyloveher/xianyu-publisher.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "闲鱼自动发布工具" (onlyloveher/xianyu-publisher) from ClawHub.
Skill page: https://clawhub.ai/onlyloveher/xianyu-publisher
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3, pip
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install xianyu-publisher

ClawHub CLI

Package manager switcher

npx clawhub@latest install xianyu-publisher
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description (闲鱼自动发布 using Playwright) is plausible, but the package requests python3/pip and asks to pip install Playwright (Python). The repository contains a JavaScript library (lib/xianyu-browser.js) that expects a Node-style browser instance (mentions puppeteer usage in its run note). The SKILL.md also shows Python module usage and CLI commands (xianyu-publish, xianyu-login) that are not provided by the repo. Requiring Python/Playwright is inconsistent with the included JavaScript code and the lack of Node/npm dependency declarations.
!
Instruction Scope
SKILL.md instructs running CLI commands (xianyu-login, xianyu-publish) and using a Python module interface (xianyu_publisher) but the only library present is Node-style JS. The instructions reference cookie persistence and local image paths (expected), but they don't specify where cookies are stored or how credentials are persisted. There are also claims (anti-detection, batch publish CLI) that the code doesn't visibly implement or document. This gives the agent broad, unspecified discretion and leaves gaps about file access and state storage.
!
Install Mechanism
There is no formal install spec for the included JavaScript code. The SKILL.md recommends pip install playwright and playwright install chromium (Python Playwright), but the code is a Node JS module that would typically require Node and puppeteer or Playwright for Node. This mismatch means following the provided install steps won't install the actual runtime dependencies for the included code.
Credentials
The skill declares no required environment variables or credentials, which is proportional for a browser automation tool that uses QR login and local cookies. However, SKILL.md and code mention cookie persistence and reading local image files; the exact storage paths and permissions are not declared. That gap should be clarified because persistent local cookies or saved session files are sensitive and should be explicit.
Persistence & Privilege
always is false and the skill doesn't request elevated platform privileges. It doesn't declare modifications to other skills or system-wide config. No unusual persistence or privilege escalation is requested by metadata.
What to consider before installing
Do not install or run this skill until the author clarifies a few things: (1) Is this a Python Playwright project or a Node/JavaScript project? The repository contains only JS but the instructions install Python Playwright. (2) Provide exact install steps for the code you ship (Node/npm or pip), and declare any CLI entrypoints and where they are installed. (3) Explain where login cookies/session state are stored and how to control/delete them. (4) Confirm whether any telemetry or external endpoints are contacted beyond the documented taobao URLs. Also consider platform policy and account-risk: automated posting can trigger bans on 闲鱼/淘宝 — use test accounts and follow rate limits. If the author cannot clarify these inconsistencies, treat the package as untrusted.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🐟 Clawdis
OSLinux · macOS · Windows
Binspython3, pip
latestvk977dsm3p32wj96kkjbbgn0t6h84063t
268downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0
Linux, macOS, Windows

闲鱼自动发布工具

基于Playwright的闲鱼自动化发布解决方案。

安装

# 安装playwright
pip install playwright
playwright install chromium

快速开始

1. 发布单个商品

# 配置商品信息
goods = {
    "title": "【AI代写】演讲稿 述职报告 小说创作",
    "price": 30,
    "description": "24小时出稿,不满意可免费修改...",
    "images": ["/path/to/image1.jpg", "/path/to/image2.jpg"]
}

# 发布商品
xianyu-publish --goods goods.json

2. 批量发布

xianyu-publish --batch goods-list.json --interval 60

使用方式

命令行

# 登录闲鱼
xianyu-login

# 发布商品
xianyu-publish --config goods.json

# 查看已保存的账号
xianyu-accounts

作为Python模块

from xianyu_publisher import GoodsPublisher, GoodsInfo

# 创建商品
 goods = GoodsInfo(
    title="商品标题",
    price=100,
    description="商品描述",
    images=["image1.jpg"]
)

# 发布
publisher = GoodsPublisher()
await publisher.publish(goods)

配置说明

商品信息格式 (goods.json)

{
  "title": "商品标题(必填)",
  "price": 100,
  "original_price": 150,
  "description": "商品详细描述",
  "images": ["/path/to/image1.jpg", "/path/to/image2.jpg"],
  "category": "分类",
  "location": "发货地",
  "delivery": "包邮",
  "tags": ["标签1", "标签2"]
}

功能特性

  • ✅ 自动登录(支持Cookie持久化)
  • ✅ 商品信息发布
  • ✅ 图片批量上传
  • ✅ 价格设置
  • ✅ 批量发布(带间隔)
  • ✅ 反检测机制
  • ✅ 登录状态保存

注意事项

  1. 首次使用需要登录:运行后会弹出浏览器窗口,请扫码登录
  2. 登录状态会保存:Cookie保存在本地,下次自动登录
  3. 建议控制发布频率:避免触发闲鱼风控
  4. 图片路径:需要提供本地图片的绝对路径

风险提示

  • 本工具仅供学习和效率提升使用
  • 请遵守闲鱼平台规则,合理使用自动化工具
  • 过度频繁的操作可能导致账号受限

开源协议

AGPL-3.0 License


联系与支持

  • 微信: 190569625(备注:闲鱼工具)
  • 有问题或需要定制服务可联系

商业使用请联系作者获取授权。

Comments

Loading comments...