xiangqin

• Verdict: Pass
• Confidence: High
• Analyzed: Apr 23, 2026, 10:29 PM
• Findings: 0
• Version: 0.7.1

Overview

The skill's requirements and runtime instructions are internally consistent with a CLI-based matchmaking integration; it asks the agent to run the xq CLI, store a session token locally, and optionally configure an agent gateway — nothing requested or instructed is disproportionate to that purpose.

This skill appears to do what it says (drive a xiangqin CLI). Before installing: (1) prefer installing the CLI in a venv/container and pin a known-good version rather than blindly upgrading; (2) verify the PyPI package and upstream GitHub repo if you care about supply-chain risk; (3) be cautious when entering your phone number and SMS verification codes — those are required for registration but are sensitive; (4) treat ~/.xiangqin/session.json as a secret and protect it with filesystem permissions; (5) only set agent_gateway_url / agent_hooks_token to endpoints you control or trust (push notifications go to URLs you provide); (6) upgrades (pip install -U) occur only with your explicit consent per the SKILL.md — confirm before running any upgrade commands.