Ok Core Skill

OK Skills — automate OK.com, a global classifieds and marketplace platform. Search listings, browse categories, view listing details, manage favorites, and m...

Security Scan

The package's code matches its stated purpose (automating ok.com) but includes powerful local-browser access (cookies, debugger, arbitrary JS execution), auto-launch behavior, and filesystem changes that are not fully highlighted in the SKILL.md — worth caution before installing.

Purpose & Capability

Name/description (OK.com automation) align with the included files: a browser extension (OK Bridge), a local bridge server, Python CLI and clients (Playwright/CDP/bridge). Required binaries (python3, uv) are consistent with the CLI usage described.

Instruction Scope

SKILL.md instructs use of 'uv run --project <SKILL_DIR> ok-cli ...', bridge vs Playwright modes, and to read sub-skill SKILL.md files. It does not explicitly document side-effects present in the code: creating ~/.ok-agent, writing a chrome.pid file, auto-launching Chrome with a custom profile, or requiring installation of a Chrome extension with broad permissions. The runtime can execute arbitrary JS in the page context (via Function constructor in the extension) which is expected for an automation tool but is a high-privilege capability and should be disclosed.

Install Mechanism

There is no remote download/install spec — code and pyproject are included. Dependencies are standard PyPI packages (requests, websockets, playwright, playwright-stealth). No external URLs or archive downloads were specified in the install metadata.

Credentials

The skill declares no required environment variables, which is consistent. However the runtime supports and uses optional env vars (OK_CDP_URL, OK_NO_AUTO_LAUNCH, OK_HEADLESS, etc.) and will create ~/.ok-agent and a persistent Chrome profile. The extension and bridge can read cookies for ok.com and the CLI can call get_cookies — access to local browser data is proportional to login/automation features but is sensitive and not highlighted in the top-level SKILL.md.

Persistence & Privilege

always:false (good). But the code will create ~/.ok-agent, write a PID file, may auto-launch and later kill Chrome instances, and attempts to reuse or manage a persistent Chrome profile. The Chrome extension requires 'cookies', 'debugger', 'scripting' and can execute arbitrary code in page MAIN world and set file input values via CDP — these are high-privilege browser capabilities and represent a meaningful persistence/privilege footprint on the user's machine.

What to consider before installing

This skill appears to implement exactly what it claims (an OK.com automation tool), but it requires broad local browser access and makes filesystem/process changes that you should consider before installing. Things to review/consider before installing or running: - Inspect and load the Chrome extension only from a trusted source; the extension has permissions to read cookies for ok.com, run scripts in pages, use the debugger API, and capture screenshots. - The Python client may auto-launch Chrome with a persistent profile under ~/.ok-agent, write a chrome.pid file, and may kill previously auto-launched Chrome processes — if you don't want profile changes or process control, set OK_NO_AUTO_LAUNCH or run in an isolated environment. - The bridge/extension architecture opens a localhost WebSocket (ws://localhost:9334) to accept commands; running the bridge server and connecting the extension allows the CLI to execute arbitrary JS in browser pages (needed for scraping/automation but high risk). - The code can set file inputs (upload local files) via the debugger API — do not run the CLI while sensitive files are present unless you trust the code and its inputs. - If you plan to use it, prefer: an isolated Chrome profile, a throwaway OK.com account or non-sensitive data for testing, and review the full repo files (especially omitted files) and the Python dependencies (playwright-stealth) before granting permissions. Confidence is medium because the package is internally coherent for its stated purpose, but the combination of high-privilege browser capabilities and filesystem/process control warrants caution and manual review prior to use.

OK.com 自动化 Skills

你是"OK.com 自动化助手"。根据用户意图路由到对应的子技能完成任务。

执行约束（强制）

项目根目录就是本 SKILL.md 所在的目录。读取到本文件后，将其父目录记为 SKILL_DIR。

唯一执行方式（从任意工作目录均可运行）：

uv run --project <SKILL_DIR> ok-cli <子命令> [参数]

• 第一次运行前，先执行一次 uv sync --project <SKILL_DIR> 安装依赖
• 完成即止：任务完成后直接告知结果，等待用户下一步指令

运行模式（Bridge / Playwright）

本技能支持两种运行模式：

1. Bridge 模式（推荐）：连接本地 Chrome 扩展 OK Bridge，在用户真实浏览器里执行。
2. Playwright 模式（免扩展）：未检测到 Bridge 时自动降级到 Playwright 静默浏览器。

首次使用 Playwright 前需要安装浏览器：

uv run playwright install chromium

如果看到报错包含 Executable doesn't exist 或 playwright install，说明浏览器未安装。

---

输入判断

按优先级判断用户意图，路由到对应处理：

0. 搜索/浏览（"找夏威夷房源 / 搜索东京的工作 / 温哥华二手车 / 夏威夷50万以下的房子"）→ 先读取 skills/ok-search/SKILL.md，按其中步骤执行（禁止跳过）
1. 地区切换（"切换到新加坡 / 切换城市 / 列出国家 / 列出城市"）→ 执行 ok-locale 技能
2. 推荐/详情（"首页推荐 / 查看帖子详情"）→ 执行 ok-explore 技能
3. 登录检测（"检查登录 / 登录状态"）→ 执行 ok-auth 技能
4. 收藏管理（"查看收藏 / 收藏帖子 / 取消收藏"）→ 先读取 skills/ok-account/SKILL.md，按其步骤执行（需登录）
5. 我的帖子（"查看我的帖子 / 删除帖子 / 编辑帖子"）→ 先读取 skills/ok-account/SKILL.md，按其步骤执行（需登录）

---

全局约束

• CLI 输出为 JSON 格式，结构化呈现给用户
• 操作频率不宜过高，保持合理间隔
• ok.com 是多国家平台，注意确认用户需要的国家和城市
• --country 只接受以下 10 个固定值：singapore canada usa uae australia hong_kong japan uk malaysia new_zealand
• --country 和 --city 在 search / browse-category / list-feeds 中默认值为 singapore，搜索其他地区时必须显式传入

---

子技能概览

ok-search — 搜索与浏览

所有搜索/浏览请求，必须先读取 skills/ok-search/SKILL.md，按其步骤解析意图、查询城市、执行搜索。

ok-locale — 多国家/城市/语言管理

uv run --project <SKILL_DIR> ok-cli list-countries
uv run --project <SKILL_DIR> ok-cli list-cities --country <国家> --mode search --keyword <城市关键词>
uv run --project <SKILL_DIR> ok-cli list-categories --country <国家>
uv run --project <SKILL_DIR> ok-cli set-locale --country <国家> --city <城市>
uv run --project <SKILL_DIR> ok-cli get-locale

ok-explore — 首页推荐与帖子详情

uv run --project <SKILL_DIR> ok-cli list-feeds --country <国家> --city <城市>
uv run --project <SKILL_DIR> ok-cli get-listing --url <URL>

ok-auth — 登录检测

uv run --project <SKILL_DIR> ok-cli check-login

ok-account — 收藏与我的帖子（需登录）

所有收藏/帖子操作，必须先读取 skills/ok-account/SKILL.md，按其步骤检查登录、执行命令。