Security checks across malware telemetry and agentic risk
The skill performs the coupon task, but it also installs and runs under-disclosed authentication, device-fingerprinting, global HTTP-patching, scheduled automation, and self-updating background components.
Install only if you trust this publisher and are comfortable logging into Meituan through it. Before using it, review that it can store local tokens and device identifiers, run scheduled coupon claims, inspect diagnostic logs, patch outgoing HTTP requests for signing, and start a CLIGuard background updater. Prefer not installing until the publisher narrows or clearly documents the daemon, updater, fingerprinting, and token-handling behavior.
# 清除 pt-passport CLI 本地缓存的 Token
cli_cleared = False
try:
result = subprocess.run(
["pt-passport", "logout", "--client_id", CLIENT_ID],
capture_output=True, text=True, timeout=10
)# 同时清除 pt-passport CLI 缓存
try:
subprocess.run(
["pt-passport", "logout", "--client_id", CLIENT_ID],
capture_output=True, text=True, timeout=10
)if is_windows:
DETACHED_PROCESS = 0x00000008
CREATE_NEW_PROCESS_GROUP = 0x00000200
subprocess.Popen(
['node', _CLIGUARD_WRAPPER_PATH, '--start'],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,env=env,
)
else:
subprocess.Popen(
['node', _CLIGUARD_WRAPPER_PATH, '--start'],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,"const r=addCommonParams(" + json.dumps(url_str) + ");"
"console.log(r.url)"
)
result = subprocess.check_output(['node', '-e', js_code], timeout=5, stderr=subprocess.PIPE)
injected = result.decode('utf-8').strip()
return injected if injected else url_str
except Exception as e:f"const {{signRequest}}=require({json.dumps(_CLIGUARD_PATH)});"
f"console.log(JSON.stringify(signRequest({json.dumps(method.upper())},{json.dumps(url_str)},{json.dumps(body_hash)})))"
)
result = subprocess.check_output(
['node', '-e', js_code],
timeout=5,
stderr=subprocess.PIPE,f"const {{signRequest}}=require({json.dumps(_CLIGUARD_PATH)});"
f"console.log(JSON.stringify(signRequest({json.dumps(method.upper())},{json.dumps(url_str)},{json.dumps(body_hash)})))"
)
result = subprocess.check_output(
['node', '-e', js_code],
timeout=5,
stderr=subprocess.PIPE,65/65 vendors flagged this skill as clean.