闲鱼自动回复助手

闲鱼自动回复助手。帮用户配置并运行闲鱼（Goofish）消息自动回复服务。用户只需提供浏览器 Cookie，即可持续监听闲鱼消息并用 AI 智能回复买家。当用户提到闲鱼、咸鱼、Goofish、二手交易自动回复、闲鱼客服机器人、闲鱼消息监控、闲鱼挂机回复等关键词时触发此 skill。即使用户只是说'帮我自动回复闲鱼...

This skill appears to do what it says: it needs your Goofish (闲鱼) browser Cookie so it can act as you and listen/send messages on your account. Before installing, review the included Python scripts (they will be copied to ~/.xianyu-agent and run in the background). Key points to consider: - A browser Cookie is equivalent to a login credential: only provide it if you trust the skill and the environment; rotate/change credentials if you suspect compromise. - The skill will connect to goofish.com, h5api.m.goofish.com, passport.goofish.com and a wss://wss-goofish.dingtalk.com WebSocket — this is consistent with the stated design but means network activity will originate from your machine. - The skill calls local AI CLIs (claude or openclaw). Ensure those CLI binaries are from trusted sources, because the skill will execute them via subprocess. - The skill stores config and chat history in plaintext under ~/.xianyu-agent; consider filesystem permissions and whether you want those files on your machine. - If you are uncomfortable running third‑party code on your primary account, consider running it in an isolated environment (container or dedicated machine) and only providing a throwaway/test account first. Overall, the package is internally consistent and not requesting unrelated secrets, but exercise normal caution because the cookie grants account access and the process will run continuously on your system.

Type: OpenClaw Skill Name: xianyu-reply Version: 1.0.0 The skill automates Xianyu (Goofish) message replies by requiring users to provide their browser Cookie, which is a high-risk credential providing full account access. While the implementation in `xianyu_monitor.py` and `xianyu_api.py` appears to communicate only with official Xianyu and DingTalk domains (e.g., `wss-goofish.dingtalk.com`) and stores data locally in `~/.xianyu-agent/`, the handling of sensitive session tokens and the execution of background monitoring processes are inherently risky. The skill uses local AI CLI tools like `claude` or `openclaw` to generate replies, and includes a custom MessagePack decoder in `xianyu_utils.py` to handle Xianyu's binary WebSocket protocol, but no clear evidence of intentional malice or data exfiltration to third-party servers was detected.