日本雅虎拍卖估价

日本雅虎拍卖商品估价工具 - 自动获取商品信息、查询历史成交价、计算建议出价

This skill appears to do what it claims: it scrapes Yahoo Auctions and aucfree using curl invoked from a Node script, and asks you to set PROXY_SOCKS5 so requests appear to come from Japan. Before installing or running: (1) only set PROXY_SOCKS5 to a proxy you trust (a malicious proxy URL could intercept traffic or, because the proxy string is interpolated into a shell command, could be abused if you set an unexpected value); (2) run the script in an isolated environment or container if you are concerned about network scraping; (3) verify you are comfortable with outbound network access to auctions.yahoo.co.jp and aucfree.com; (4) if you will pass untrusted IDs or environment values, consider reviewing or sanitizing inputs to avoid command-injection risks. Overall the skill is internally consistent and proportionate to its stated purpose.

Type: OpenClaw Skill Name: yahoo-auction-estimator Version: 1.0.3 The skill is classified as suspicious due to a critical shell injection vulnerability in `scripts/estimate.mjs`. User-provided auction IDs from `process.argv` are directly interpolated into a URL string, which is then passed to `execSync` within a `curl` command without proper shell escaping. This allows an attacker to execute arbitrary commands on the host system by crafting a malicious auction ID (e.g., `b1220553804; rm -rf /`). While the skill's stated purpose and network calls to Yahoo Auctions and aucfree.com appear legitimate, the lack of input sanitization for `execSync` constitutes a severe security flaw.