闲鱼自动回复助手

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:44 AM UTC
• Version: 1.0.0

Overview

This skill is a real auto-reply bot, but it asks for a full login cookie, stores it in plaintext, and can automatically send AI-written marketplace messages.

Review carefully before installing. Treat the requested Cookie like a password: pasting it into chat and storing it in plaintext can expose the account. Only use this with a dedicated low-risk account, after understanding that buyer conversations may be sent to the configured AI CLI/provider and that replies are sent automatically without human approval.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:61

Finding

Full Browser Session Cookie Is Collected Through Chat and Stored in Plaintext

Content

View full analysis

", "created_at": "<当前ISO时间>", "auto_reply": true, "simulate_typing": false, "heartbeat_interval": 15, "message_expire_time": 300000 } ``` ``` `references/cookie_guide.md:23-30` reinforces disclosure of the entire credential: ```markdown 4. **找到 Cookie** - 在请求列表中随便点一个请求（优先选 `.json` 或 `XHR` 类型） - 在右侧找到「请求标头 / Request Headers」部分 - 找到 `Cookie:` 这一行 - 它的值是一长串文本，格式类似：`key1=value1; key2=value2; key3=value3` 5. **复制 Cookie** - 双击 Cookie 值全选，然后 `Ctrl+C`（或 `Cmd+C`）复制 - 粘贴发给 AI 助手即可 ``` ### Technical Analysis The requested cookie is an authenticated browser-session credential, not merely a low-privilege identifier. The implementation subsequently uses values such as `cookie2`, `_m_h5_tk`, `XSRF-TOKEN`, and `unb` to authenticate API and WebSocket operations. Requesting the entire cookie through an AI chat creates an additional exposure boundary. Depending on the agent platform, the credential may be retained in conversation history, execution traces, support logs, model-provider records, or audit telemetry. This conflicts with the documentation's broad assertion that the cookie is not uploaded. T ...[truncated 1824 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/xianyu_monitor.py:194

Finding

Buyer-Controlled Messages Can Inject Instructions into Automatically Sent AI Replies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/xianyu_monitor.py:146

Finding

Buyer Conversations May Be Disclosed to Cloud-Backed AI CLI Providers Contrary to the Declared Network Boundary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is extremely broad and includes common conversational phrases, so the skill may activate in ordinary discussions about 闲鱼/Goofish rather than only when the user wants credentialed automation. In this context, accidental activation is risky because the skill then guides credential collection, local persistence, package installation, and background service startup.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the user to copy and paste a full browser Cookie, which is an authentication credential that can enable account access or session hijacking if exposed. It does so without prominent warning, minimization, or safer alternatives, making sensitive credential exfiltration through normal chat interaction more likely.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This is a natural-language workflow for collecting a full browser cookie from the user and retaining it for ongoing automated access. That is sensitive credential harvesting and persistence: anyone with access to the conversation, logs, or local files may be able to reuse the session and act as the user.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs writing the user's cookie in plaintext to ~/.xianyu-agent/config.json, creating persistent local storage of a live authentication credential. Plaintext credential storage materially raises the risk of theft via other local processes, backups, shared accounts, or accidental disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document normalizes disclosure of login cookies by presenting them as necessary for the program to connect and act under the user's identity. Because the skill is specifically designed to monitor messages and send replies on the user's behalf, this framing encourages users to surrender powerful authentication material without adequate security controls or warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide explicitly tells users to copy their full authenticated browser Cookie and paste it to the AI assistant, which is equivalent to handing over live login credentials. Anyone or any system receiving that cookie may be able to impersonate the user, access account data, send messages, and potentially take further actions until the session expires or is revoked.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Instructing users to paste full login cookies directly to an AI assistant is a direct credential disclosure pattern. In this skill context, the danger is elevated because the cookie is not just incidental data: it is the mechanism that lets the service act as the user on Xianyu, so disclosure immediately enables account takeover-like abuse within the session scope.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/xianyu_monitor.py (reported line 158)May include surrounding context.

python

cmd,
                capture_output=True, text=True,
                timeout=60,
                env={**os.environ, 'LANG': 'zh_CN.UTF-8'}
            )

            if result.returncode == 0 and result.stdout.strip():

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill directs shell execution, file reads/writes, environment checks, package installation, and networked long-running automation, but declares no explicit tool scope or permissions boundary. That mismatch increases the chance the agent will run powerful operations without clear user-facing authorization or sandbox constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document states that buyer messages, product information, and conversation history are sent to an AI CLI for reply generation, but gives no clear privacy or data-transfer warning. Depending on the CLI/backend, this may expose personal or commercially sensitive data to an external model provider or local logs without informed consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill aggregates buyer messages, item data, and chat history into prompts for model processing, which increases privacy exposure and may disclose unnecessary personal or business information. Because the workflow is automated and continuous, the volume and sensitivity of exposed data can grow over time without granular user review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill creates a persistent working directory, stores state and chat history, and later runs a background monitor process with a PID file. In this context, persistence matters because it supports unattended long-lived access to account messaging and retained credentials/data beyond the immediate session.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

1. 创建工作目录

bash

mkdir -p ~/.xianyu-agent/{data,logs}

2. 复制脚本 — 从当前 skill 目录的 scripts/ 复制到工作目录。使用 skill 的绝对路径（即这个 SKILL.md 文件所在目录下的 scripts/）：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill creates a persistent working directory, stores state and chat history, and later runs a background monitor process with a PID file. In this context, persistence matters because it supports unattended long-lived access to account messaging and retained credentials/data beyond the immediate session.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

1. 创建工作目录

bash

mkdir -p ~/.xianyu-agent/{data,logs}

2. 复制脚本 — 从当前 skill 目录的 scripts/ 复制到工作目录。使用 skill 的绝对路径(即这个 SKILL.md 文件所在目录下的 scripts/):

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document assures users that the Cookie stays local and 'will not be uploaded to any server,' but the skill's purpose is to automate message handling with AI, which commonly involves transmitting conversation content and possibly related metadata to external services. This creates a misleading trust boundary: even if the raw Cookie is stored locally, the guide omits clear disclosure about what data leaves the machine and how the automation stack actually uses sensitive session material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This module persistently stores chat messages, item details, descriptions, and bargaining metadata in a local SQLite database, but there is no evidence in this file of consent, retention controls, encryption, or access restrictions. In the context of an auto-reply skill for a marketplace platform handling buyer conversations, this creates privacy and data-protection risk because potentially sensitive personal and transactional data is retained on disk and could be exposed to other local users, backups, or malware.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.32.3 — 4 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs) +1 more

Medium

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is pinned to requests==2.32.3, which is reported with known security advisories including credential leakage risks involving .netrc handling and malicious URLs. In the context of a skill that processes browser cookies and likely makes authenticated network requests to external services, using a vulnerable HTTP client increases the chance that sensitive credentials or session data could be exposed if attacker-controlled URLs or related code paths are reached.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The request headers explicitly set Accept-Language to 'zh-CN,zh;q=0.9', which hard-codes a language/locale preference. Under the policy, forcing a specific language without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The login request includes 'lang': 'zh_CN', which enforces a specific language/locale in the skill's behavior. The file does not indicate that users can choose another locale or that this restriction is explicitly documented as a region-specific requirement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill's advertised purpose is message auto-reply, but it delegates core behavior to locally installed AI executables with broader capabilities than the skill declares. In this context, that means untrusted buyer-controlled text is being forwarded into a separate agent/tool boundary that may have filesystem, network, or plugin capabilities, increasing the chance of prompt-driven unintended actions or data disclosure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/xianyu_monitor.py (reported line 95)May include surrounding context.

python

"""检测可用的 AI CLI 工具"""
        for tool in ['claude', 'openclaw']:
            try:
                result = subprocess.run(
                    ['which', tool],
                    capture_output=True, text=True, timeout=5
                )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Buyer messages, item metadata, and prior chat context are embedded into the prompt and sent to a local AI CLI without any explicit disclosure, opt-in, or data minimization. Because this skill continuously monitors private marketplace conversations, forwarding that content to another executable materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

The script sends dynamically constructed prompts containing buyer messages, item details, and conversation history to an external local CLI tool via subprocess. Although shell injection is avoided by passing an argument list, this still expands the skill's execution surface and hands untrusted conversational content to another executable, which may itself perform network access, logging, or tool use outside the user's expectations.

Content

Scanner excerpt · scripts/xianyu_monitor.py (reported line 154)May include surrounding context.

python

else:
                cmd = ['openclaw', 'agent', '--prompt', prompt]

            result = subprocess.run(
                cmd,
                capture_output=True, text=True,
                timeout=60,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The subprocess environment unconditionally sets LANG to zh_CN.UTF-8, which enforces a specific language/locale behavior. This is a natural-language policy concern because the file does not provide user opt-in, language selection, or documentation that the tool is intentionally restricted to Chinese-only operation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The prompt includes prior conversation history and the latest buyer message verbatim, allowing a buyer to ask the model to restate, summarize, or transform previously supplied content. In an auto-reply bot for marketplace chats, that creates a real prompt-injection and privacy leakage risk because one party can influence how the model exposes earlier messages or seller-provided context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code loads a user-provided authenticated browser cookie and immediately uses it to establish network-authenticated access to the platform, but there is no user-facing disclosure or consent checkpoint in the code path. In a skill that asks for browser cookies, this is especially sensitive because such cookies may grant full account access and can be abused if mishandled, logged, or reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.