xianyu service ops

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Xianyu marketplace-operations playbook with no executable code or hidden access, but users should review its optional context persistence and marketplace-growth tactics before using it.

Install only if you want Xianyu-specific service-selling guidance. Do not put credentials, customer data, payment information, or private account details in `.claude/xianyu-context.md`; treat any advice about account seasoning or moving buyers to WeChat as tactics to verify against Xianyu's current rules before acting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README states the skill activates whenever Xianyu-related topics are mentioned and should be used proactively, which creates an overly broad trigger surface. In practice this can cause the skill to engage in conversations where the user did not explicitly request marketplace-ops guidance, increasing the chance of irrelevant instruction injection, unintended data exposure to the skill context, or policy-bypassing behavior through automatic mode switching.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to create a persistent `.claude/xianyu-context.md` file that the skill reads at the start of each session, but it does not provide an explicit privacy notice, data minimization guidance, or warning against storing sensitive information. This can lead users to persist account status, business details, or personal data that is automatically reloaded in future sessions, expanding exposure if the file contains confidential or regulated information.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description says to use the skill proactively when the user 'wants to start/grow a service-based side hustle on a Chinese consumer marketplace,' which is broader than the enumerated Xianyu-specific phrases. That wording can overlap with general entrepreneurship or marketplace advice requests and does not give clear exclusion conditions for non-Xianyu marketplaces.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The phrase 'Always use this skill — not general advice — when the context is Xianyu service selling' mandates invocation but does not define borderline cases, such as secondhand goods, general Chinese marketplace strategy, or cross-platform growth discussions. Without explicit exclusions, the trigger scope is underspecified for a manifest-style description.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The skill is tightly bound to a Chinese platform and repeatedly prescribes Chinese-platform-specific workflows, terminology, and outputs, but it does not explicitly ask the user to opt into Chinese-language or China-marketplace context. This can create a locale policy issue if invoked for users who have not chosen that language/region context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Telling new sellers to make small purchases 'as a buyer' to establish account trust encourages artificial reputation or behavioral gaming unrelated to legitimate service delivery. Even if framed as account seasoning, it promotes manipulation of platform trust signals and can normalize deceptive conduct that undermines marketplace integrity.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly advises routing users from Xianyu to WeChat private channels and using external-platform acquisition flows. That expands the skill from benign in-platform listing optimization into off-platform circumvention behavior that can violate marketplace rules, reduce platform oversight, and facilitate transactions outside approved protections.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The eval prompt and expected output are explicitly written to operate in Chinese for Xianyu-specific listing generation, with no indication that language choice is optional or that the skill is limited to Chinese-speaking users by documented design. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This scenario likewise hardcodes Chinese-language interaction and output expectations for marketplace optimization advice, but does not state that the skill is restricted to a Chinese locale or offer any user language preference. The issue is repeated natural-language policy noncompliance rather than a one-off prompt wording choice.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The document is presented almost entirely in Chinese service names, pricing conventions, and platform-specific context tied to Xianyu, without offering any language or locale choice. This can violate the language/locale policy because the skill content implicitly assumes a Chinese-language, China-market context without explicit opt-in or a documented regional justification.

Static analysis

No suspicious patterns detected.