Agent skill

Goofish Risk Guard

by fancyboi999 in fancyboi999/goofish-cli

闲鱼风控/合规预检 skill。何时激活:用户要发商品、回消息、降价改标前让你 "看看这样行不行"、"会不会违规"、"会不会封号"、"会不会限流";或用户说 "被限流了/曝光掉了怎么办";或被 goofish-publish-item / goofish-reply-buyer 调用做预检。功能:发布前扫描(绝对化词、类目偏差、降价改标、9 图合规), 发送前扫描(外联词、误导承诺),触发…

Apache-2.0Auto-check passed

Install Goofish Risk Guard

skills CLI
$ npx skills add fancyboi999/goofish-cli --skill goofish-risk-guard -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install fancyboi999/goofish-cli goofish-risk-guard --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/fancyboi999/goofish-cli.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/goofish-risk-guard .claude/skills/goofish-risk-guard && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
goofish-risk-guard
GitHub stars
309
Token cost
~727 tokens
SKILL.md length
207 words
Files
5 (incl. references)
Skills in repo
5
Repo updated
First seen
Licence
Apache-2.0

At a glance

闲鱼风控/合规预检 skill。何时激活:用户要发商品、回消息、降价改标前让你 "看看这样行不行"、"会不会违规"、"会不会封号"、"会不会限流";或用户说 "被限流了/曝光掉了怎么办";或被 goofish-publish-item / goofish-reply-buyer 调用做预检。功能:发布前扫描(绝对化词、类目偏差、降价改标、9 图合规), 发送前扫描(外联词、误导承诺),触发…

  • Works in 4 steps: 告诉用户:服务端风控已触发,原因可能是短时高频写 / 多号同 IP / 新增风险行为 → 引导用户:打开浏览器登录闲鱼,正常浏览 3-5 分钟,触发 x5sec /… → 用户执行 goofish auth login --browser chrome… → …
  • SKILL.md covers 工具命名, 定位, 三道闸门 and 决策框架:什么时候"拒绝帮忙", plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Goofish Risk Guard is an agent skill from fancyboi999/goofish-cli. 闲鱼风控/合规预检 skill。何时激活:用户要发商品、回消息、降价改标前让你 "看看这样行不行"、"会不会违规"、"会不会封号"、"会不会限流";或用户说 "被限流了/曝光掉了怎么办";或被 goofish-publish-item / goofish-reply-buyer 调用做预检。功能:发布前扫描(绝对化词、类目偏差、降价改标、9 图合规), 发送前扫描(外联词、误导承诺),触发 RGV587 风控后的恢复指引。 本 skill 主要是知识库 + 检查清单,不直接替用户改文案——由调用方 skill 拿检查结果去改。

Its SKILL.md is about 730 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including reference files (for example `references/external-contact-keywords.md`, `references/forbidden-words.md` and `references/publish-red-lines.md`).

It works with Model Context Protocol. The repository describes itself as: 闲鱼 CLI · 原生支持 MCP · 为 AI Agent 而生 | Goofish (Xianyu) automation CLI · MCP-ready · Built for AI Agents. The licence is Apache-2.0.

Example prompts

  • “看看这样行不行”
  • “;或用户说”
  • “/goofish-risk-guard”

Requirements

  • Pre-approved tools (allowed-tools): mcp__goofish__auth_status, mcp__goofish__search_items, mcp__goofish__item_get, mcp__goofish__auth_reset_guard

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. 告诉用户:服务端风控已触发,原因可能是短时高频写 / 多号同 IP / 新增风险行为
  2. 引导用户:打开浏览器登录闲鱼,正常浏览 3-5 分钟,触发 x5sec / mtop_partitioned_detect cookie 下发
  3. 用户执行 goofish auth login --browser chrome 重新导入(带 x5sec)
  4. 如果仍失败 → 建议 2-6 小时后再来

What it can do on your machine

Read from SKILL.md and the folder at commit c2b397f. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • mcp__goofish__auth_status
    • mcp__goofish__search_items
    • mcp__goofish__item_get
    • mcp__goofish__auth_reset_guard

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Goofish Risk Guard loads about 727 tokens when it runs, and up to ~4.8k if it reads all its reference files. Until then it costs about 73 tokens; SKILL.md has 207 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~73
When it runs · the whole SKILL.md, loaded when a task matches
~727
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from fancyboi999/goofish-cli at commit c2b397f, republished under its Apache-2.0 licence (© fancyboi999). 207 words, ~727 tokens.

Download SKILL.mdSave it as .claude/skills/goofish-risk-guard/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
goofish-risk-guard
description
闲鱼风控/合规预检 skill。何时激活:用户要发商品、回消息、降价改标前让你 "看看这样行不行"、"会不会违规"、"会不会封号"、"会不会限流";或用户说 "被限流了/曝光掉了怎么办";或被 `goofish-publish-item` / `goofish-reply-buyer` 调用做预检。功能:发布前扫描(绝对化词、类目偏差、降价改标、9 图合规), 发送前扫描(外联词、误导承诺),触发 RGV587 风控后的恢复指引。 **本 skill 主要是知识库 + 检查清单,不直接替用户改文案**——由调用方 skill 拿检查结果去改。
allowed-tools
mcp__goofish__auth_status, mcp__goofish__search_items, mcp__goofish__item_get, mcp__goofish__auth_reset_guard
metadata.author
goofish-cli
metadata.version
0.3.0
metadata.tags
xianyu, risk, compliance, guard

闲鱼风控预检

工具命名

正文使用 auth_status 这类逻辑名。OpenClaw 调 goofish__<逻辑名>; Claude Code / Cursor 调 mcp__goofish__<逻辑名>。frontmatter 的 allowed-tools 保留 Claude 权限预批准格式,OpenClaw 不读取该字段。

定位

这是 被其它 skill 频繁调用的知识库型 skill。Agent 读它的 references,不一定要调 MCP 工具。

其它 skill 什么时候应该引用本 skill:

上游 skill引用点
goofish-publish-item标题/描述生成后、发布前 → forbidden-words.md + publish-red-lines.md
goofish-reply-buyer起草回复后、send 前 → external-contact-keywords.md
goofish-shop-diagnosis归因分析阶段 → publish-red-lines.md 里的降权触发项

三道闸门

闸门 1 · 发布前扫描

输入:标题 / 描述 / 价格 / 图片数 / 类目 / 历史价格(若有) 输出:{ blockers: [...], warnings: [...], suggestions: [...] }

blockers(必须改,否则拒绝发布):

  • 绝对化词(最/顶/第一/绝对/全网最低等,详见 forbidden-words.md)
  • 外联词(同上,消息和商品描述都禁)
  • 品牌侵权(非授权卖 Nike/LV 等一线品牌)
  • 类目明显错放(比如"手机壳"放到"数码-手机")

warnings(建议改):

  • 标题缺结构(没品牌 / 没核心词 / 没规格)
  • 图片 < 3 张
  • 首图非 1:1
  • 描述 < 30 字(信息不足,买家不问直接跳过)

suggestions(可选优化):

  • 按"品牌+核心词+属性+场景+情感" 5 段式补全
  • 建议加成色描述(95 新 / 8 成新 / 有瑕疵具体说明)

具体规则见 references/publish-red-lines.md。

闸门 2 · 发消息前扫描

输入:草稿 text 输出:{ block: bool, reason: str, replacement: str | None }

命中规则(详见 references/external-contact-keywords.md):

  • 外联关键词 → block=True,提供合规替换
  • 诱导线下担保 → block=True
  • 误导性承诺("包真"、"假一赔十"但无凭证)→ warning
  • 情绪失控词("你脑子有病"、"去死")→ warning
闸门 3 · RGV587 / x5sec 恢复

当 MCP 调用返回 FAIL_SYS_ILLEGAL_ACCESS 或 RGV587:

不要做:

  • 重试(会进一步触发风控)
  • 建议用户 auth_login(覆盖 cookie 后丢失 x5sec,更糟)
  • 建议用户 auth reset-guard(只解本地熔断,不解服务端)

要做(按顺序):

  1. 告诉用户:服务端风控已触发,原因可能是短时高频写 / 多号同 IP / 新增风险行为
  2. 引导用户:打开浏览器登录闲鱼,正常浏览 3-5 分钟,触发 x5sec / mtop_partitioned_detect cookie 下发
  3. 用户执行 goofish auth login --browser chrome 重新导入(带 x5sec)
  4. 如果仍失败 → 建议 2-6 小时后再来

详见 references/x5sec-recovery.md。

决策框架:什么时候"拒绝帮忙"

这些请求 拒绝并解释,不要找绕过路径:

用户请求为什么拒
"帮我写个微信号的隐藏方式" / "帮我躲过外联词检测"违反平台规则 + 本工具合规声明红线
"帮我刷单/做假交易"同上
"帮我批量注册小号" / "帮我伪造设备 ID"同上
"帮我把这个假货说成真的"欺诈
"帮我写差评报复别的卖家"恶意
"帮我规避封号后的账号找回"绕过平台风控

话术模板:

这个请求踩到了闲鱼平台的合规红线({具体项}),本工具不协助这类操作。你可以考虑 {合规替代方案}。

工具使用

大部分检查不需要调 MCP 工具——读 references 就够。需要时:

  • search_items:查买家视角能否搜到自家商品(诊断限流)
  • item_get:拉自家商品历史元数据(判断是否降价改标了)
  • auth_status:调其它工具前确认登录态

写操作本 skill 完全不调(item_publish / media_upload / message_send / item_delete 都不在 allowed-tools)。

© fancyboi999, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (references) in skills/goofish-risk-guard of fancyboi999/goofish-cli.

  • SKILL.md
  • references/external-contact-keywords.md
  • references/forbidden-words.md
  • references/publish-red-lines.md
  • references/x5sec-recovery.md

Open the folder on GitHubat commit c2b397f

Compare with similar skills

Goofish Risk Guard next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Goofish Risk Guard compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Goofish Risk Guard this skillfancyboi999/goofish-cli309—~727Automated safety check: PassApache-2.0
MCP Server Builderanthropics/skills180k63 repos~2.3kAutomated safety check: PassApache-2.0
MCP Server BuildershareAI-lab/learn-claude-code78k4 repos~1.2kAutomated safety check: PassMIT
MCP Integration for Pluginsanthropics/claude-plugins-official38k11 repos~3.1kAutomated safety check: PassApache-2.0
Figma use_figma Plugin API Ruleswarpdotdev/warp65k4 repos~4.4kAutomated safety check: PassAGPL-3.0
Stitch to Remotion Walkthrough Videosgoogle-labs-code/stitch-skills8.5k6 repos~3.2kAutomated safety check: NotesApache-2.0

Similar skills

  • MCP Server Builder

    anthropics/skills

    Official

    Guides the design and implementation of Model Context Protocol servers in TypeScript or Python, from tool naming and error messages to evaluation.

    180k GitHub starsUsed in 63 repos~2.3k tokens
    Agent WorkflowsAuto-check passed
  • MCP Server Builder

    shareAI-lab/learn-claude-code

    Walks through building MCP servers in Python or TypeScript that expose tools, resources and prompts to Claude, with templates, registration and testing.

    78k GitHub starsUsed in 4 repos~1.2k tokens
    Agent WorkflowsAuto-check passed
  • MCP Integration for Plugins

    anthropics/claude-plugins-official

    Official

    Explains how to bundle Model Context Protocol servers in a Claude Code plugin, covering config files, stdio, SSE, HTTP and WebSocket server types, and authentication.

    38k GitHub starsUsed in 11 repos~3.1k tokens
    Agent WorkflowsAuto-check passed
  • Required groundwork before any use_figma call: the rules and reference files for running JavaScript in a Figma file through the Plugin API without common failures.

    65k GitHub starsUsed in 4 repos~4.4k tokens
    Frontend & DesignAuto-check passed
  • Stitch to Remotion Walkthrough Videos

    google-labs-code/stitch-skills

    Official

    Builds walkthrough videos from Stitch design projects using Remotion, with transitions, zoom effects and text overlays on each screen.

    8.5k GitHub starsUsed in 6 repos~3.2k tokens
    Media & CreativeAuto-check: notes
  • MCP Development

    coollabsio/coolify

    A skill your agent uses for Laravel MCP development. An agent skill from coollabsio/coolify.

    63k GitHub starsUsed in 1 repo~949 tokens
    Frontend & DesignAuto-check passed

More from fancyboi999/goofish-cli

  • Goofish Publish Item

    fancyboi999/goofish-cli

    闲鱼发商品 skill。何时激活:用户说"帮我发到闲鱼 / 挂个闲置 / 把 XX 上架 / 发布一件 / 新增商品 / 上新";或说"这个怎么写标题 / 类目该选啥 / 图片够了吗"。

    309 GitHub stars~928 tokensUpdated yesterday
    Auto-check passed
  • Goofish Reply Buyer

    fancyboi999/goofish-cli

    闲鱼买家消息回复 skill。何时激活:用户说"看看我有没有未读 / 回复下买家 / 有人问 XX 怎么办 / 他要砍价我怎么办 / 帮我回一下消息 / 处理下催付 / 议价策略"。

    309 GitHub stars~805 tokensUpdated yesterday
    Auto-check passed
  • Goofish Shop Diagnosis

    fancyboi999/goofish-cli

    闲鱼店铺 / 商品诊断 skill。何时激活:用户说"我店铺没流量 / 曝光掉了 / 怎么没人问 / 是不是被限流 / 帮我看看为啥没单 / 哪里出问题了"。功能: 用 searchitems 做"买家视角"查自家商品是否露出 → itemview 拉详情 对比排查 → 按归因清单给出"限流可能性 + 修复建议"。本 skill 纯读, 不做任何写操作——只诊断不修,修留给…

    309 GitHub stars~682 tokensUpdated yesterday
    Auto-check passed
  • Goofish Overview

    fancyboi999/goofish-cli

    闲鱼(goofish.com)自动化运营的总入口 skill。何时激活:用户首次提到 闲鱼 / 咸鱼 / goofish / 二手交易 / 挂闲置 / 回买家消息 / 发商品到闲鱼, 或用户询问本工具如何使用、有哪些能力、能做什么。本 skill 介绍 goofish-cli 的定位、账号模型、17 个 MCP 工具速查、风控底线,并指向其它专项 skill…

    309 GitHub stars~688 tokensUpdated yesterday
    Auto-check passed

Questions about Goofish Risk Guard

What does Goofish Risk Guard do?

闲鱼风控/合规预检 skill。何时激活:用户要发商品、回消息、降价改标前让你 "看看这样行不行"、"会不会违规"、"会不会封号"、"会不会限流";或用户说 "被限流了/曝光掉了怎么办";或被 goofish-publish-item / goofish-reply-buyer 调用做预检。功能:发布前扫描(绝对化词、类目偏差、降价改标、9 图合规), 发送前扫描(外联词、误导承诺),触发…. Goofish Risk Guard is an agent skill from fancyboi999/goofish-cli.

How do I install Goofish Risk Guard in Claude Code?

Run `npx skills add fancyboi999/goofish-cli --skill goofish-risk-guard -a claude-code`. Or copy the skill folder (skills/goofish-risk-guard in fancyboi999/goofish-cli) into .claude/skills/goofish-risk-guard in your project. Claude Code loads it when a task matches its description.

How do I install Goofish Risk Guard in Codex?

Run `npx skills add fancyboi999/goofish-cli --skill goofish-risk-guard -a codex`. Or copy the skill folder (skills/goofish-risk-guard in fancyboi999/goofish-cli) into .agents/skills/goofish-risk-guard in your project. Codex loads it when a task matches its description.

Can I use Goofish Risk Guard in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add fancyboi999/goofish-cli --skill goofish-risk-guard -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/goofish-risk-guard, .gemini/skills/goofish-risk-guard, .github/skills/goofish-risk-guard and .opencode/skills/goofish-risk-guard in your project.

What does Goofish Risk Guard need to run?

SKILL.md names no scripts, command-line tools or credentials: Goofish Risk Guard is instructions for the agent only. Its frontmatter pre-approves these tools: mcp__goofish__auth_status, mcp__goofish__search_items, mcp__goofish__item_get, mcp__goofish__auth_reset_guard.

Does Goofish Risk Guard access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Goofish Risk Guard safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Goofish Risk Guard use?

Goofish Risk Guard is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Goofish Risk Guard use?

About 727 tokens (SKILL.md is roughly 2.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4k tokens, read only when the agent opens those files.

What are the alternatives to Goofish Risk Guard?

Skills that share tags, products or a category with Goofish Risk Guard: MCP Server Builder (anthropics/skills, 180k stars), MCP Server Builder (shareAI-lab/learn-claude-code, 78k stars), MCP Integration for Plugins (anthropics/claude-plugins-official, 38k stars) and Figma use_figma Plugin API Rules (warpdotdev/warp, 65k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Goofish Risk Guard?

fancyboi999 (a GitHub user) maintains it in fancyboi999/goofish-cli, which has 309 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on October 10, 2026.

Source: fancyboi999/goofish-cli on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.