The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the local Google Chrome profile directory (~/Library/Application Support/Google/Chrome/Default) to maintain the user's login session on the Xianyu platform. While necessary for the skill's primary purpose of browser automation, this grants the agent access to all sensitive data stored in the browser profile, including cookies and history.
[COMMAND_EXECUTION]: The framework extracts external data such as buyer nicknames and product titles from the web page and interpolates them directly into shell scripts and API requests. In monitor.sh and fulfillment-templates/05-api-delivery.sh, the variables are used in shell contexts (including heredocs) without sanitization. A malicious buyer could potentially use a nickname containing shell sub-commands (e.g., $(...)) to achieve arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill performs outbound network operations using curl to interact with user-configurable API endpoints and notification services (Telegram, WeWork) as seen in fulfillment-templates/05-api-delivery.sh and the examples in SKILL.md.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the following attack surface:
Ingestion points: Untrusted data including buyer nicknames, product titles, and chat messages are ingested via agent-browser snapshot in monitor.sh, xianyu-monitor-agent.sh, and xianyu-monitor-final.sh.
Boundary markers: The skill lacks boundary markers or instructions to isolate untrusted web content from its core logic.
Capability inventory: The skill possesses significant capabilities including shell command execution, browser interaction via agent-browser, and network access via curl.
Sanitization: The skill performs no validation, escaping, or filtering on external data before using it to drive automated actions or populating shell environment variables.

xianyu-auto-fulfillment