goofish-search-list — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited goofish-search-list (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
keyword + optional filters → list of 30 second-hand item cards per page (id, title, price, image, location, want-count)
All process output to user (progress updates, process notifications) follows the user's language.
Extract second-hand item listing cards from Goofish keyword search results, supporting sort options, price range filters, and publish-date filters, with page-by-page pagination.
https://www.goofish.com/search?q={keyword}If browser-act has been confirmed available in the current session → skip this step.
Invoke browser-act via Skill tool to load usage. If installation or configuration issues arise, follow its guidance to resolve then retry.
If login status for Goofish has been confirmed in the current session → skip this step.
Otherwise: open https://www.goofish.com/ and observe the page:
This Skill's operational boundary = what the user can manually do in their browser. It only reads data already displayed to the user on the page. JS code is encapsulated in Python files under thescripts/directory, invoked viaeval "$(python scripts/xxx.py {params})".$(...)is bash syntax; it is recommended to use the bash tool for execution.
Search requests use a dynamic sign token computed client-side — they cannot be reconstructed directly. Navigate to the search URL to trigger the API automatically.
navigate https://www.goofish.com/search?q={keyword}wait stableError handling: If the page shows a CAPTCHA slider ("Please slide to verify") instead of search results, the session has been rate-limited. Wait 5–10 minutes before retrying, or switch to a fresh browser session.
After navigating and waiting stable, extract all 30 item cards on the current page:
eval "$(python scripts/extract-search-items.py)"
Output example:
{
"items": [
{
"item_id": "1054668718340", // unique item ID
"category_id": "126862528", // category ID
"item_url": "https://www.goofish.com/item?id=1054668718340&categoryId=126862528",
"title": "美版iPhone 14 国行256G 纯原 原版原漆", // full title text
"image_url": "https://img.alicdn.com/bao/uploaded/...", // thumbnail URL
"price": "1810", // numeric string, CNY, no ¥ sign
"service_tag": "Apple/苹果256GB无任何维修", // condition/attribute tag or recency label, null if absent
"price_desc": "2人想要", // want-count or price-drop info, null if absent
"location": "广东" // seller's location province/city
}
],
"count": 30
}Apply sort order, publish-date filter, or price range before extracting. Call before running extract-search-items.py. After calling, wait stable before extracting.
eval "$(python scripts/apply-search-filters.py --sort {sort} --publish-days {days} --price-min {min} --price-max {max})"
Parameters:
--sort: Sort option — "" default (综合), "reduce" price-drop (新降价), "create" newest (新发布), "price-asc" price low-to-high, "price-desc" price high-to-low. Default: ""--publish-days: Filter by publish date — "" all, "1" within 1 day, "3" within 3 days, "7" within 7 days, "14" within 14 days. Default: ""--price-min: Minimum price (CNY integer string, e.g., "500"). Requires --price-max. Default: ""--price-max: Maximum price (CNY integer string, e.g., "3000"). Requires --price-min. Default: ""Output example:
{
"ok": true,
"applied": {
"sort": "reduce:desc",
"searchFilter": "publishDays:7;priceRange:500,3000;"
}
}eval "$(python scripts/goto-page.py {page_number})"
Parameters:
page_number: Target page number (integer, 1-based)Output example:
{ "ok": true, "clicked_page": 2 }After clicking, wait stable then re-run extract-search-items.py to get the new page's items.
[AI] sort options: "" (综合/default), "reduce" (新降价), "create" (新发布/最新), "price-asc" (价格从低到高), "price-desc" (价格从高到低)
[AI] publish-days filter: "" (all), "1", "3", "7", "14"
DOM Pagination: Click the target page number button using goto-page.py {page}, then wait stable, then re-run extract-search-items.py. Page numbers appear in the pagination bar at the bottom of the search results.
Termination: When goto-page.py returns error: Page N not found — no more pages available, or the target page exceeds the pagination range displayed (typically up to 25 pages / 750 items).
result count >= 1 and item_id non-null rate = 100% and price non-null rate >= 80%
sign token in search API requests is computed client-side; direct API replay without browser context is not supported — always trigger via page navigationPath: {working-directory}/browser-act-skill-forge-memories/xianyu-scraper-goofish-search-list.memory.md
Before execution: If the file exists, read it first — it records unexpected situations encountered during past executions (e.g., a strategy has become ineffective); adjust strategy order accordingly.
After execution: If an unexpected situation is encountered (strategy became ineffective, page redesigned, anti-scraping upgraded, better path discovered), append a line: {YYYY-MM-DD}: {what happened} → {conclusion}
Normal execution does not write to the file. Do not record what keywords were used or how many results were returned — those are task outputs, not experience.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.