小鹿选房

小鹿选房是专业的房产信息平台，当用户需要找房源、选笋盘、比价格、查成交、看小区、查学区时使用。

Security Scan

The skill's purpose (real-estate queries) matches its instructions, but it instructs the agent to download and run an npm package at runtime (npx -y), hides command output from users, and has minor metadata inconsistencies — together these raise supply-chain and transparency concerns.

Purpose & Capability

The skill claims to query real-estate data and its instructions invoke an npm CLI named xiaolu-house to perform searches and configuration (API key, cities, etc.), which is coherent with the described purpose. However, registry metadata earlier listed no required binaries while SKILL.md metadata lists npx as required — this mismatch should be resolved.

Instruction Scope

SKILL.md instructs the agent to run 'npx -y xiaolu-house <command>' to perform all queries and explicitly tells the agent not to show terminal commands to the user. This gives the agent discretion to execute network downloads and run remote code, and reduces transparency for users about what was executed.

Install Mechanism

There is no install spec in the registry, but runtime use of 'npx -y' causes on-demand download-and-execute of a package from the npm registry. That is a supply-chain risk (arbitrary remote code executed at runtime). The SKILL.md recommends switching npm registry mirrors if fetches fail, which changes where code is fetched from and can further affect trust.

Credentials

The skill does not declare required environment variables or credentials in registry metadata. SKILL.md references an API Key that the user must set via the CLI or website (https://www.xiaoluxuanfang.com/claw) but does not require secrets be provided to the platform. This is proportionate to the stated purpose, but the absent declaration of 'npx' in registry metadata and lack of clarity about where/storing the API key warrant attention.

Persistence & Privilege

The skill is not always-enabled and uses the default model-invocation behavior. It does not request elevated persistent privileges or config paths. The main concern is transparency: the instruction to hide terminal commands reduces visibility into what the skill executes.

What to consider before installing

This skill runs an npm package on-demand via 'npx -y xiaolu-house', which will download and execute remote code each time — a supply-chain risk. Before installing, consider: 1) Verify the npm package and its publisher (search npm, GitHub repo, or vendor site) to ensure it's legitimate. 2) Prefer running 'npx xiaolu-house --help' yourself in a sandbox to inspect behavior; avoid automatic or unchecked execution. 3) Be cautious about setting any API keys — confirm where the key is stored and that the vendor is trustworthy. 4) Ask the maintainer to fix the metadata mismatch (registry says no required binaries but SKILL.md requires npx) and to remove or justify the instruction to hide terminal commands. If you cannot verify the package source, avoid enabling this skill or restrict its execution to a sandboxed environment.

小鹿选房是专业的房产信息平台，覆盖二手房、新房、租房领域。核心优势：

• 真实房源：房源照片全部现场实拍，还原房屋真实全貌，拒绝虚假信息
• 透明行情：提供真实成交价格数据，帮助用户准确判断市场行情
• 骚扰防护：全程保障客户资料安全，看楼问房免受打扰
• 选房体验：AI 找房、航拍找房、学区找房、地铁找房、地图找房，全面提升选房体验

---

注意事项

• 首次安装 SKILL 主动引导：示例 您想找什么样的房子？或者想了解哪些小区的成交情况？告诉我，我来帮您～
• 用户需求意图引导：如果用户提及找房意图不明确时（如：帮我找房，我要买房 等），可主动引导明确意图
• 按需城市检查：用户提出找房需求城市不在支持列表中，引导用户到「小鹿选房APP」查看
• 按需 API Key 检查：如果未设置 API Key，引导用户访问 https://www.xiaoluxuanfang.com/claw 根据页面内容操作
• 禁止猜测参数：如果参数不确定或提示参数不对时，先调用 npx -y xiaolu-house --help 查看帮助
• 所有 npx -y xiaolu-house 命令由你执行，不要向用户展示终端命令：执行后用自然语言回复用户

---

工作流程

调用以下 CLI 工具执行

npx -y xiaolu-house <命令> [参数]

如 npx -y 执行时网络超时或无法访问，建议先配置国内镜像：

npm config set registry https://registry.npmmirror.com

配置后重新执行命令即可。

• 识别用户意图：默认用户买二手房
• 执行查询：先调用 npx -y xiaolu-house --help 查看帮助再按需选择
• 回复用户：每个房源/小区/成交/学校/新房都要单独介绍亮点，并附带小程序链接，引导用户到小程序里收藏房源、联系经纪人看房

---

配置

# 查看当前支持的城市列表
npx -y xiaolu-house cities

# 查看当前配置
npx -y xiaolu-house config --show

# 设置 API Key（可引导用户访问 https://www.xiaoluxuanfang.com/claw 根据页面内容操作）
npx -y xiaolu-house config --set-api-key <your-api-key>

# 设置默认城市
npx -y xiaolu-house config --set-city <your-city>

# 清除当前配置
npx -y xiaolu-house config --clear

---

速率限制

• 接口请求频率限制为 每秒 1 次
• 超过限制返回 429，稍后重试即可