Jinguyuan Dumpling Skill

What to consider before installing: - The skill does what it claims (restaurant info + Meituan queue) but its embedded Meituan component will: (a) run an OAuth/install flow that can install/use an mt-passport CLI and store tokens at ~/.xiaomei-workspace/mt_passport_auth.json, and (b) perform an automatic version check that can download and extract a zip from a remote CDN into the skill directory. Both behaviors give the skill the ability to write persistent files and to pull new code from the network at runtime. - Risks: remote code updates (the version checker will fetch and extract archives), token handling/exposure (LLM is instructed to inline tokens into shell commands), and undeclared env/files (the manifest doesn't list the env vars/files the scripts actually use). These increase the chance of accidental credential exposure or execution of unexpected code. - Recommendations: 1. If you want to use it, run it in an isolated/sandboxed environment (not a production machine) so updates and scripts cannot affect sensitive data. 2. Require explicit user confirmation before allowing the skill to perform the version update or install CLIs; prefer to run the scripts with visibility rather than letting them auto‑update each invocation. 3. Inspect and vet the remote CDN URLs in version_config.json and the downloaded package contents before trusting automatic updates; consider locking the skill to a vetted local copy and disabling the updater. 4. Be cautious about providing tokens or letting the agent perform OAuth on your behalf; if possible, supply a short‑lived token and verify where it will be stored and used. 5. If you cannot review the code and CDN content, decline installation or mark the skill as agent-invocable only with human approval (no autonomous runs). Summary: coherent purpose but contains runtime behaviors (automatic remote updates, token storage and inline token injection into shell commands) that are high risk if used without review — treat as suspicious and take the precautions above before installing.