goofish-overview
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The tool manages highly sensitive Xianyu session credentials, including _m_h5_tk, cookie2, and x5sec cookies, which are stored in ~/.goofish-cli/cookies.json. Unauthorized access to these files allows for complete account takeover.
- [REMOTE_CODE_EXECUTION]: The mcp__goofish__skills_install tool facilitates the installation of additional functional modules by copying files into the agent's skills directory (~/.claude/skills/). This mechanism allows for the dynamic expansion of the agent's executable instructions and could be abused to introduce malicious logic.
- [PROMPT_INJECTION]: The skill facilitates interaction with untrusted external data, such as buyer messages and item descriptions, which presents a surface for indirect prompt injection. 1. Ingestion points: Tools message_list_chats, message_history, and item_view in references/mcp-tools-index.md. 2. Boundary markers: No explicit data delimiters or instructions to ignore embedded commands are present in the processing logic. 3. Capability inventory: The agent possesses high-impact write capabilities including message_send, item_publish, and item_delete. 4. Sanitization: The skill lacks intrinsic sanitization or validation of external input, relying instead on recommended manual conventions.
- [COMMAND_EXECUTION]: The system operates via a Python CLI and MCP server that utilizes Playwright for automated browser interactions and shell execution to manage platform operations.
Audit Metadata