Beijing Signed Price Tracker

Track configured Beijing Housing Commission new-home projects from bjjs.zjw.beijing.gov.cn project-detail URLs, read project signed-unit counts, signed area,...

Security Scan

The skill's code and instructions broadly match its stated purpose (crawling Beijing housing pages and writing to Feishu), but there are several coherence and privacy concerns — notably hard-coded Feishu credentials and absolute local paths — that make it risky to install without further changes or review.

Purpose & Capability

The name/description (track Beijing Housing Commission project pages and persist signed-room rows to a Feishu sheet) aligns with the included code: tracker.js crawls bjjs.zjw.beijing.gov.cn and writes/notifications use Feishu APIs. However the package contains embedded Feishu credentials (appSecret / spreadsheetToken) and sheet tokens in projects.json / last-sync files, and the registry metadata declares no required env vars — that mismatch (secrets committed into repo rather than declared/asked-for) is unexpected and poor practice.

Instruction Scope

SKILL.md instructs the agent to crawl project pages, follow '查看更多' and paginated lists, maintain a local room-cache, write rows to a Feishu spreadsheet, and send Feishu DMs. The code implements those actions and only reads/writes its local files (projects.json, room-cache.json, last-sync*.json) and interacts with two external hosts (the Beijing site and open.feishu.cn). Concern: the monitoring script (scripts/monitor-tracker-runs.js) reads a hard-coded RUNS_PATH pointing to an absolute path under /home/SENSETIME/..., which accesses system-local run logs outside the skill directory — that file access is outside the documented scope and could read unrelated local data.

Install Mechanism

There is no install spec (instruction + node scripts), so nothing is downloaded or installed by the registry. The code runs under node and performs network I/O; no remote archives, obscure package installs, or URL downloads were present in the provided files.

Credentials

The feature legitimately needs Feishu credentials (appId/appSecret and sheet identifiers) to update sheets and send DMs — the SKILL.md documents env var overrides (FEISHU_*). But the registry metadata lists no required env vars, and the repository includes plaintext secrets (projects.json contains appId/appSecret/spreadsheetToken and last-sync files also include tokens). Committing active secrets into the skill bundle is disproportionate and exposes credentials to anyone with access to the skill files.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It writes local caches and last-sync files within the skill directory (expected), and is allowed to call Feishu APIs (expected for its purpose). The only persistence concern is the use of an absolute RUNS_PATH in scripts/monitor-tracker-runs.js which reads a host-specific cron/runs JSONL — that is a cross-cutting read of system-local state and should be configurable or documented.

Scan Findings in Context

[hardcoded_feishu_app_secret_in_projects_json] unexpected: projects.json contains appId/appSecret and spreadsheetToken in plaintext. While the skill needs Feishu credentials to function, bundling active credentials in the code/repo is not expected and leaks sensitive tokens. User should treat these as compromised and not reuse them.

[hardcoded_sheet_tokens_in_last_sync_files] unexpected: last-sync.json and last-sync-wutong.json include spreadsheetToken and sheetId. Storing tokens in runtime artifacts committed with the skill exposes them; tokens should be supplied at runtime or via environment variables.

[absolute_runs_path_in_monitor_script] unexpected: scripts/monitor-tracker-runs.js uses RUNS_PATH = '/home/SENSETIME/.../cron/runs/…jsonl' to find previous run logs. This is an absolute system path that reads outside the skill directory; it's not documented in SKILL.md and is unexpected for a generic skill bundle.

What to consider before installing

This skill appears to implement the tracking and Feishu integration it promises, but there are important warnings before you install or run it: (1) The bundle includes active Feishu credentials and sheet tokens in projects.json and last-sync files — treat those as leaked and do NOT reuse them; instead, supply your own credentials via environment variables or a secrets store and remove any committed secrets. (2) The monitoring script reads a hard-coded absolute RUNS_PATH on the host — review and either remove or make this path configurable to avoid reading unrelated local logs. (3) Because the skill will be able to post to and modify a Feishu spreadsheet and send DMs, only provide Feishu credentials with the minimum necessary scope and to an account/app you control and can revoke. (4) Run the code in an isolated environment (or review the full tracker.js) before giving it production credentials; rotate any credentials if you previously used the ones embedded in the repo. If you want, I can: (a) point out exact lines in the files to change to remove hard-coded secrets and make RUNS_PATH configurable, or (b) show how to run the tracker safely with ephemeral/test Feishu credentials.

使用 scripts/tracker.js 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入飞书表格。

核心文件

• projects.json：项目映射 + 飞书表格配置
• scripts/tracker.js：抓取、解析、估算、写入、排序主脚本
• room-cache.json：本地房源缓存（缓存未签约房屋的建筑面积/户型，供后续签约时补齐）

满足的规则

1. 允许配置多个地块名到北京住建委项目详情链接的映射；同一地块名也可以绑定多个项目详情链接，并在同步时合并处理。
2. 从项目详情页提取：
   • 已签约套数
   • 已签约面积(M2)
   • 成交均价（￥/M2）
3. 从楼盘表页提取每套房的：
   • 销售楼号
   • 自然楼层
   • 房号
   • 销售状态
4. 如果项目详情页有“查看更多”，继续抓取 pageId=411612 楼盘表列表页。
5. 如果楼盘表列表页有多页，依次处理全部页。
6. 将 已签约 与 网上联机备案 统一视为签约房屋。
7. 账本仍以飞书表格为唯一真实历史来源；但会额外维护本地 room-cache.json，缓存未签约房屋的 建筑面积 与 户型。
8. 同步时会先扫描整盘楼盘表；对可访问房屋详情页的未签约房源补缓存；对已签约 / 网上联机备案房号，判断其是否已经存在于飞书表格中。
9. 上次查询基线按地块名从飞书表格中反向解析；如果不存在，则 已签约套数、已签约面积(M2)、项目成交均价 都视为 0。
10. 新签约均价按面积差公式估算：

估计新签约均价 = (本次已签约面积 * 本次项目成交均价 - 上次已签约面积 * 上次项目成交均价) / (本次已签约面积 - 上次已签约面积)

11. 飞书表格列固定为：

地块名,销售楼号,自然楼层,房号,建筑面积,户型,估计成交价,项目已签约套数,已签约面积(M2),项目成交均价,更新时间

12. 写入时只在表格底部追加新行；历史行内容不回写、不改单元格值。允许统一排序，也允许从旧版 8 列表头迁移到新版 11 列表头（旧数据新增列会留空）。
13. 追加完成后，对整张表按以下优先级排序：
    • 地块名
    • 更新时间
    • 销售楼号
    • 自然楼层
    • 房号
14. 更新时间统一使用 YYYY-MM-DD HH:MM:SS。
15. 每次执行结束后都发飞书私聊通知：
    • 有新增签约：通知内容为本次新增行，按窄屏友好格式分组展示
    • 无新增签约：发送“本次无新增签约”摘要

飞书表格约束

• 飞书表格是唯一真实数据源。
• 首次使用时，如果表格为空，脚本会自动写入表头。
• 如果表格首行是旧版 8 列表头，脚本会自动迁移为新版 11 列表头，并保留历史行。
• 如果表格首行既不是新版也不是旧版表头，脚本会报错停止，避免破坏历史数据。
• 如果飞书应用没有该表格权限，脚本会提示你在文档右上角添加文档应用。

本地缓存约束

• 本地缓存文件：room-cache.json
• 缓存 key：地块名 + 销售楼号 + 自然楼层 + 房号
• 仅用于补充签约后无法再读取的 建筑面积 与 户型
• 如果房屋在签约前未曾成功缓存，则签约入表时对应列会为空，并在同步报告中给出警告

状态颜色

scripts/tracker.js 按楼盘表颜色识别状态：

• #FF0000 → 已签约
• #d2691e → 网上联机备案
• #FFCC99 → 已预订
• #33CC00 → 可售
• #CCCCCC → 不可售
• #ffff00 → 已办理预售项目抵押
• #00FFFF → 资格核验中

只有 已签约 和 网上联机备案 会写入飞书表格；未签约状态会用于刷新本地缓存。

配置文件格式

projects.json 示例：

{
  "feishu": {
    "sheetUrl": "https://my.feishu.cn/sheets/Y944sbj2khtLcNtb7jec7MIrnxd",
    "spreadsheetToken": "Y944sbj2khtLcNtb7jec7MIrnxd",
    "sheetId": "eee767",
    "sheetTitle": "Sheet1",
    "appId": "cli_xxx",
    "appSecret": "xxx",
    "notifyUserOpenId": "ou_xxx"
  },
  "projects": [
    {
      "name": "清樾府04地块",
      "url": "http://bjjs.zjw.beijing.gov.cn/eportal/ui?pageId=320794&projectID=8138177&systemID=2&srcId=1"
    }
  ]
}

也可以通过环境变量覆盖：

• FEISHU_SHEET_URL
• FEISHU_APP_ID
• FEISHU_APP_SECRET
• FEISHU_NOTIFY_USER_OPEN_ID

命令

node scripts/tracker.js set-feishu --sheet-url "https://my.feishu.cn/sheets/Y944sbj2khtLcNtb7jec7MIrnxd" --app-id "cli_xxx" --app-secret "xxx" --notify-user-open-id "ou_xxx"
node scripts/tracker.js add --name "清樾府04地块" --url "http://bjjs.zjw.beijing.gov.cn/eportal/ui?pageId=320794&projectID=8138177&systemID=2&srcId=1"
# 同一地块名重复 add 新链接时，脚本会把链接追加到该地块配置下
node scripts/tracker.js list
node scripts/tracker.js sync
node scripts/tracker.js sync --name "清樾府04地块"

也可以临时同步一个未写入配置的项目：

node scripts/tracker.js sync --name "临时项目" --url "http://bjjs.zjw.beijing.gov.cn/eportal/ui?pageId=320794&projectID=8138177&systemID=2&srcId=1" --sheet-url "https://my.feishu.cn/sheets/Y944sbj2khtLcNtb7jec7MIrnxd" --app-id "cli_xxx" --app-secret "xxx"

实施要求

• 先使用项目详情页统计值作为总量基准，再扫描楼盘表找具体房号。
• 必须处理“查看更多”和分页，不能只依赖项目详情页第一页展示的部分楼栋。
• 同步时顺带刷新可访问房屋详情页的未签约房源缓存。
• 如果 签约套数变化 与 本次发现的新房号数 不一致，输出警告，但仍按当前楼盘表结果判断哪些房号需要新增。
• 如果项目总签约套数或签约面积下降，不回滚历史数据，只报告异常。
• 如果楼盘表出现历史没有的新房号，但项目签约面积没有增加，则跳过这些房号并给出警告，避免估价失真。
• 默认顺序抓取，避免高频并发请求。
• 排序通过脚本在读取全部账本后统一重写已排序区间完成。

通知规则

• 每次执行结束都会发飞书私聊通知。
• 有新增时，通知内容就是新增行本身，按地块分组并适配手机窄屏阅读。
• 没有新增时，发送简短摘要，说明“本次无新增签约”。
• 通知目标由 feishu.notifyUserOpenId（或环境变量 FEISHU_NOTIFY_USER_OPEN_ID）控制。