Security audit
Security checks for vulnerabilities and agentic risk
This Meituan coupon and ordering skill is mostly purpose-related, but it also stores sensitive account/location state and runs self-updating background infrastructure that deserves review before use.
Install only if you trust this publisher with your Meituan login, precise recent location, local credential storage, and order creation. Review the bundled CLIGuard self-update/daemon behavior and disable or avoid scheduled auto-claim/location authorization if you do not want persistent background activity or future silent location lookups.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 清除 pt-passport CLI 本地缓存的 Token
cli_cleared = False
try:
result = subprocess.run(
["pt-passport", "logout", "--client_id", CLIENT_ID],
capture_output=True, text=True, timeout=10
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 同时清除 pt-passport CLI 缓存
try:
subprocess.run(
["pt-passport", "logout", "--client_id", CLIENT_ID],
capture_output=True, text=True, timeout=10
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if is_windows:
DETACHED_PROCESS = 0x00000008
CREATE_NEW_PROCESS_GROUP = 0x00000200
subprocess.Popen(
['node', _CLIGUARD_WRAPPER_PATH, '--start'],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env=env,
)
else:
subprocess.Popen(
['node', _CLIGUARD_WRAPPER_PATH, '--start'],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"const r=addCommonParams(" + json.dumps(url_str) + ");"
"console.log(r.url)"
)
result = subprocess.check_output(['node', '-e', js_code], timeout=5, stderr=subprocess.PIPE)
injected = result.decode('utf-8').strip()
return injected if injected else url_str
except Exception as e:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
f"const {{signRequest}}=require({json.dumps(_CLIGUARD_PATH)});"
f"console.log(JSON.stringify(signRequest({json.dumps(method.upper())},{json.dumps(url_str)},{json.dumps(body_hash)})))"
)
result = subprocess.check_output(
['node', '-e', js_code],
timeout=5,
stderr=subprocess.PIPE,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
f"const {{signRequest}}=require({json.dumps(_CLIGUARD_PATH)});"
f"console.log(JSON.stringify(signRequest({json.dumps(method.upper())},{json.dumps(url_str)},{json.dumps(body_hash)})))"
)
result = subprocess.check_output(
['node', '-e', js_code],
timeout=5,
stderr=subprocess.PIPE,
Without declared permissions the skill's intent is opaque and cannot be validated.
描述覆盖了领券、搜索附近商品、位置相关查询和下单这些核心业务能力，因此主体方向与代码大体相关；但代码不仅是“领券/活动/搜索下单”工具，还实际实现了完整认证流程与本地身份持久化（get-token、auth-get-code、auth-poll-token、logout、clear-device-token）、二维码生成，以及专门的日志解密诊断脚本。这些能力不只是底层实现细节，而是对外可调用的独立功能，属于描述未提及的额外能力，因此应判定为描述与实际行为不完全一致。
The manifest says the skill covers takeout, hotels/travel, supermarkets, leisure/entertainment and other Meituan life-service decisions, and supports searching nearby group-buy products and placing orders. However, the implementation explicitly restricts search and ordering to dine-in restaurant group-buy only and states that non-dine-in categories are unsupported.
The stated purpose is coupon claiming, activity lookup, nearby product search, and ordering. The code adds a broader capability to permanently store a user's location-authorization state and reuse it in future conversations to silently fetch recent location, which is a persistent-profile behavior not justified by the manifest text.
The manifest describes on-demand coupon claiming, activity lookup, nearby search, and ordering. The implementation goes further by offering daily scheduled execution, writing local state, registering cron jobs, and sending proactive notifications, which is a separate automation capability not mentioned in the skill description.
The safety section explicitly states that '清除设备标识' must require secondary confirmation before execution. But the command handling section says the operation is triggered when the user explicitly says the phrase and then directly runs clear-device-token, with no intervening confirmation step described.
Manifest 将该 skill 描述为消费决策与领券/活动查询/下单工具，但本诊断流程包含从 ~/.xiaomei-workspace/auth_tokens.json 读取 user_token，再以命令参数形式传给脚本并“展示原始 JSON 返回”。读取认证凭据本身可作为实现细节存在，但这里将 token 提取为独立步骤并可能暴露给操作者，属于与宣称目的不直接相称的诊断能力。
Manifest 只声明领券、查询活动、搜索附近团购商品并下单，并未提到读取 /tmp/huisheng 下的鉴权日志与发券日志用于诊断。日志审计可以是运维能力，但相对技能的面向用户生活服务用途而言，这是额外的内部诊断/取证能力。
The manifest describes a skill for领取优惠券、查询活动、搜索附近团购商品并下单, centered on Meituan consumption decisions and offers. This script instead calls a dedicated endpoint to fetch the user's recent location and returns precise city, longitude, latitude, and formatted address, which is a materially different capability not described in the manifest.
Fetching and returning a user's recent location, including lng/lat and formattedAddress, is a sensitive capability. While nearby deals search may depend on location context, the manifest does not state that the skill can directly obtain and expose the user's recent location from a token, so this capability is not clearly justified by the declared purpose.
The manifest describes a生活服务优惠券 skill that领取优惠券、查询活动、搜索团购并下单. In addition to issuing coupons, this file reads ~/.xiaomei-workspace/auth_tokens.json for a device_token and uses it to derive an encryption key for logs, which is not an obvious or declared requirement of coupon issuance.
The manifest describes a broader multifunction consumer-assistance skill including 领券、查询活动、搜索附近团购商品并下单, while this script is specifically documented and implemented only for placing an order and returning order/payment information. This is a capability subset rather than an added risky behavior, but it is still a description-to-code mismatch at the manifest level for this file when read in isolation.
The manifest describes coupon领取、活动查询、搜索附近团购商品并下单, which frames the skill around coupon and nearby-deal decision support. The code exposes a first-class order command that submits purchase parameters including product ID, poi ID, token, city ID, uuid, and quantity, indicating transactional ordering capability that is broader and more concrete than the manifest’s stated coupon-centric purpose.
A consumer-facing skill for coupon claiming, activity lookup, nearby search, and ordering would be expected to call service APIs, but not to perform package installation and forced updates at runtime. Here init reconstructs a package archive and runs npm install ... --force, which is an environment-management capability unrelated to the user-facing shopping/discount function.
The manifest describes a consumer-facing Meituan coupon, activity lookup, nearby group-buy search, and ordering skill. This file bootstraps a low-level networking SDK that automatically patches requests/httpx/urllib process-wide and launches a daemon on import, which is infrastructure behavior not reflected in the stated skill purpose.
The manifest says the skill supports coupon claiming, activity queries, nearby deal search, and ordering. Here the SDK resolves core logic from ~/.cliguard/cliguard-updates when the updated package version is newer, meaning executable behavior can change via external updates independent of the packaged code, which is not described in the manifest.
The top-level usage documentation states that importing cliguard will automatically patch requests/httpx/urllib. However, the bootstrap section also calls _ensure_daemon() during import, so the documentation omits and effectively misstates a significant side effect of import.
The manifest describes a consumer-facing Meituan coupon/activity search and ordering skill, but this file implements a generic CLI wrapper that downloads code updates over HTTP(S), verifies signatures, writes files under temp/update directories, and launches a detached daemon process. Those operations are not an obvious implementation detail of coupon领取、活动查询或附近团购下单, and materially expand the skill's actual behavior beyond the stated purpose.
Detected: suspicious.dangerous_exec, suspicious.secret_argv_exposure