tianjin-house
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various subcommands of the
xiaolu-houseCLI tool vianpxto fetch real estate data, check city support, and manage local configurations. - [EXTERNAL_DOWNLOADS]: It downloads the
xiaolu-housepackage from the npm registry at runtime usingnpx -y. This behavior is expected as it is the primary method for providing the skill's functionality and aligns with the author's (fanggeek) ecosystem. - [CREDENTIALS_UNSAFE]: The skill instructs the agent to help users set an API key, which is then stored in a local configuration file at
~/.xiaolu-house/config. This is standard secret management for CLI tools and does not involve hardcoded credentials or unauthorized exfiltration.
Audit Metadata