The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell scripts for searching, detail retrieval, and account management. These scripts use python3 for safe JSON parsing and URL encoding of user-provided keywords, preventing common command injection vulnerabilities. The use of temporary files in /tmp for JavaScript payloads follows standard practices with unique process IDs to avoid collisions.
[EXTERNAL_DOWNLOADS]: The skill fetches keyword enhancement data from https://search-sharp.com/api/products. This is an informative service used to find product aliases (e.g., 'GTA' for Grand Theft Auto) to improve search results when the primary search fails. No executable code is downloaded or run from this source.
[CREDENTIALS_SAFE]: The skill manages Xianyu login sessions by caching browser cookies in ~/.cache/xianyu_cookies.txt. The ensure_tab.sh script sets these files to 0600 permissions (read/write by owner only), which is a standard security practice for local secret storage. It does not hardcode credentials or transmit them to unauthorized third parties.
[DATA_EXPOSURE]: The skill interacts with the mtop (Mobile Taobao Open Platform) APIs inside the browser to fetch the user's own orders, favorites, and published items. This data is displayed back to the user in the agent's interface. No sensitive data exfiltration to external servers was detected; data flow is strictly between the marketplace's official API and the user's terminal.

xianyu-hub