Xianyu Auto Shop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This skill is a marketplace automation tool that openly promotes anti-detection behavior and asks for broad automation permissions.

Review this carefully before installing. It may require broad UI, notification, and background-task access, and its stated behavior could affect marketplace listings, account standing, and private messages. Avoid using it unless you understand the platform-policy and privacy implications and can constrain or disable unattended automation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Excessive Privileged Permissions Declared Without Functional Need

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Excessive permission declaration and violation of least privilege
Risk Level: Medium

Complete Code Snippet:

yaml

metadata:
  openclaw:
    permissions: [accessibility, notification, auto-task]

Technical Analysis

The skill requests accessibility, notification, and auto-task permissions. However, the reviewed implementation in index.js only processes command-line arguments, generates random values, waits using timers, and writes simulated status messages to standard output.

No code was found that uses accessibility services, reads or sends notifications, or creates automatic tasks. The requested permissions therefore exceed the capabilities needed by the current implementation and violate the principle of least privilege.

Accessibility permission is particularly sensitive because, depending on the host platform's permission model, it may allow observation or control of user-interface interactions. Notification access may expose notification content or permit notification actions, while automatic-task access may allow privileged background automation. The exact scope depends on how the OpenClaw host interprets and enforces these permission identifiers.

The current index.js does not actively exercise or abuse these permissions. The risk arises from granting unnecessary capabilities to the skill package, making future malicious modifications, compromised updates, or host-integrated code substantially more capable than the present functionality requires.

Attack Path

1. A user installs or enables the skill based on its advertised marketplace automation functionality.
2. The host reads the permission declaration from SKILL.md.
3. If the host grants the declared permissions, the skill receives accessibility, notification, and automatic-task capabilities despite the current implementation not requiring them ...[truncated 1209 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all currently unused permissions from the metadata:

   yaml

   metadata:
     openclaw:
       permissions: []
   

   If the platform permits it, omit the permissions field entirely when no privileged capability is required.

2. Add permissions individually only after implementing functionality that demonstrably requires them.

3. Document the exact operation requiring each permission, the data it exposes, and whether access is continuous or limited to an explicit user action.

4. Prefer narrowly scoped platform capabilities over broad accessibility access. Marketplace operations should use an authorized, purpose-specific API where available rather than UI-wide automation privileges.

5. Require explicit user approval when introducing a new permission in a later release, rather than carrying forward unnecessary preauthorization.

6. Add a release-time check that compares declared permissions with actual API usage and rejects unused or undocumented privileged permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The description repeatedly promotes '防风控防限流' and '模拟真人操作' with randomized delays, which indicates deliberate evasion of platform detection and enforcement rather than ordinary automation. In a marketplace automation skill for Xianyu, this context makes the behavior more dangerous because it is tailored to conceal policy-violating activity at scale, enabling spammy listing manipulation and automated engagement while reducing the chance of detection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly advertises automated messaging, accessibility-based automation, and persistent message monitoring without any warning about account sanctions, privacy implications, or platform policy violations. In this context, the combination of unattended automation and message handling can expose user communications and increase the likelihood of account restrictions or misuse, making the omission materially risky rather than a harmless documentation gap.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's comments, status messages, and command help are entirely in Chinese, which imposes a specific language on users with no opt-in or fallback. This is a natural-language policy concern because the file provides no mechanism to select another language or document that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.