咸鱼自动发货

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:43 AM UTC
• Version: 0.0.1

Overview

The skill is openly aimed at automating Xianyu order fulfillment, but it asks for persistent automation in the main session and a personal Chrome profile, which is broader access than the task needs.

Review this carefully before installing. Use a dedicated browser profile logged into only the required Xianyu account, avoid storing unrelated credentials in that profile, start in manual or dry-run mode, and only enable cron after confirming the exact fulfillment source, message content, schedule, and removal command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:70
• Finding: Browser Automation Uses the User's Default Chrome Profile## Vulnerability Details **File Location**: `SKILL.md`, lines 70-73 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Vulnerable code:** ```bash agent-browser --headed --profile "$HOME/Library/Application Support/Google/Chrome/Default" open "https://www.goofish.com/im" ``` ### Technical Analysis The documented command attaches browser automation to the user's default Chrome profile. A default personal profile can contain authenticated sessions, cookies, browsing history, autofill information, and access to services unrelated to the marketplace automation task. The task only requires an authenticated Goofish session. Granting the agent access to a general-purpose browser profile therefore violates least-privilege principles. Although the command initially opens a legitimate Goofish URL, the attached automation process may retain the ability to navigate elsewhere using the same authenticated browser context. No evidence shows that the Skill intentionally extracts credentials or accesses unrelated services. The vulnerability is the unnecessary breadth of the authority granted to the automated browser. ### Attack Path 1. The user follows the documented setup command. 2. `agent-browser` starts with the user's default Chrome profile. 3. The automation process inherits browser state that may include unrelated authenticated sessions. 4. A mistaken action, malicious marketplace message, unsafe future instruction, or compromised automation component causes navigation outside the intended Goofish workflow. 5. The browser may access unrelated services under the user's existing authenticated context without requiring a new login. ### Impact Assessment The exposed scope depends on the contents of the user's default Chrome profile. Potentially affected assets include: - Authenticated sessions for unrelated websites. - Personal browsing data and cookies available to the profil ...[truncated 398 chars]
• Remediation: ## Remediation Suggestions 1. Create a dedicated Chrome profile used exclusively for Goofish automation. 2. Authenticate only the required marketplace account in that profile. 3. Do not copy cookies, extensions, saved passwords, or unrelated sessions from the user's personal profile. 4. Restrict browser navigation to an allowlist such as `https://www.goofish.com/`. 5. Prevent the automation process from opening arbitrary URLs supplied through marketplace messages. 6. Run the browser under a dedicated, minimally privileged operating-system account or sandbox where practical. 7. Update the documentation to explicitly prohibit using `Default` or another general-purpose personal browser profile. 8. Require user confirmation before navigating outside the expected order and messaging pages.

T06 · System Persistence

Warning

• Location: SKILL.md:119
• Finding: Recurring Automation Is Installed in the Shared Main Session## Vulnerability Details **File Location**: `SKILL.md`, lines 119-129 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium **Vulnerable code:** ```bash openclaw cron add \ --cron "* * * * *" \ --tz "Asia/Shanghai" \ --session main \ --wake now ``` The same requirement is also demonstrated at `SKILL.md:41-46`, where the documentation explicitly states that the main session must be used instead of an isolated session. ### Technical Analysis The Skill instructs the user to create a scheduled task that runs every minute, wakes immediately, and executes through the shared `main` session. This task survives the individual Skill invocation and continues operating across sessions until explicitly removed. Scheduled monitoring is consistent with the declared automation purpose and is not concealed. However, coupling persistent execution with the broad main session unnecessarily increases the available context and authority. A dedicated restricted session would provide stronger isolation while still supporting persistent marketplace monitoring. Repeated execution also amplifies configuration errors. An unsafe delivery workflow, incorrect order classification, or malicious content encountered during processing may be acted upon every minute rather than during a single controlled invocation. ### Attack Path 1. The user installs the documented OpenClaw cron job. 2. The job persists after the initial setup and runs every minute. 3. Each invocation wakes and operates through the shared main session. 4. The agent processes marketplace content and user-configured fulfillment instructions using that session's available context and tools. 5. A malicious message, unsafe fulfillment configuration, or automation error influences an invocation. 6. The scheduled task repeatedly re-enters the same workflow until the task is disabled or removed. ### Impact Assessment The scheduled task obtains persist ...[truncated 784 chars]
• Remediation: ## Remediation Suggestions 1. Use a dedicated automation session rather than the shared main session. 2. Grant that session access only to the dedicated Goofish browser profile and the configured fulfillment source. 3. Require explicit user confirmation before creating any recurring task. 4. Display the exact schedule, session, accessible resources, and removal command before installation. 5. Use a longer polling interval where business requirements permit. 6. Add a maximum lifetime or expiration date so the task does not run indefinitely by default. 7. Add idempotency controls so the same order cannot be fulfilled more than once. 8. Maintain a durable fulfillment ledger keyed by verified order identifier. 9. Require strict structural verification of paid-order system cards rather than trusting buyer-controlled text. 10. Restrict scheduled execution to an allowlist of browser domains, local files, and API endpoints approved by the user. 11. Pause the task automatically after repeated errors, authentication failures, or ambiguous order states. 12. Provide prominent commands and instructions for listing, pausing, and removing the scheduled job.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad terms such as 'xianyu' and '自动发货', which may cause the skill to activate in contexts where the user did not intend to invoke automated order monitoring or message sending. Because this skill can monitor chats and automatically fulfill orders, accidental invocation materially increases the chance of unintended automation against a live commerce account.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill is designed for scheduled monitoring and automatic message delivery, and it may handle sensitive fulfillment data such as activation keys, links, local key-pool files, or API-returned secrets, yet the documentation does not prominently warn about the privacy, account, and misdelivery risks. In this context, insufficient risk disclosure is more dangerous because the workflow operates continuously and can send secrets to buyers without per-order human review.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs use of a local Chrome profile in the browser automation session, which exposes existing authenticated state, cookies, and potentially saved credentials to an automated workflow. In this context, the automation also sends messages and monitors orders on a marketplace account, so misuse, prompt injection through page content, or accidental actions could affect the user's real account rather than a sandboxed session.

Static analysis

No suspicious patterns detected.