Security audit

金谷园饺子馆 Skill

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its restaurant lookup and queueing purpose, but it includes an under-disclosed Meituan signing component that creates a persistent local device identifier outside the documented token directory.

Review before installing if you are uncomfortable with local account authorization helpers. Public restaurant lookups are scoped, but queue features use Meituan authorization, store a token under ~/.jinguyuan, spawn a short-lived background auth poller, and the signing dependency also creates a persistent ~/.cliguard device identifier that the skill does not clearly disclose. Only proceed if you trust the publisher and understand that confirmed take-number/cancel actions affect a real queue account.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (1654)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 描述聚焦于金谷园饺子馆的信息查询与排队业务，但所给代码并未实现门店、菜品、排队查询或排队取号/取消等业务逻辑。相反，代码核心是一个通用的安全签名与 Passport 认证组件：它会包装全局 fetch，请求前自动补充通用参数并计算签名；同时收集本机环境信息生成指纹；并通过 CLI 完成登录认证、token 轮询、缓存管理等操作。这些能力既超出了描述范围，也访问了与餐厅业务不一致的认证服务，因此属于明显不匹配。

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The manifest limits real actions to online queue number taking, personal queue progress query, and queue cancellation, plus querying store/queue/dish information. This client also exposes generic identity capabilities for phone login, verification, token refresh, and token revocation, which are not justified by the stated user-facing purpose of a dumpling restaurant info/queue skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The manifest describes a bounded set of functions: querying shop, queue, and dish info, and performing only three real queue actions. However, the code provides generic GET/POST wrappers for arbitrary capability paths under the business API, which broadens the skill into a general API caller instead of a narrowly scoped restaurant/queue skill.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The manifest states the skill queries information through the Jinguyuan official API, but this CLI path is wired by default to `https://mcp.jinguyuan.cloud` and then dispatches capability calls through `/api/v1`. That may be an internal gateway rather than the official API described to users, creating a semantic mismatch between the declared integration and the actual network endpoint used.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: This module imports and uses OS, filesystem, path, crypto, child_process, and process APIs to derive a persistent device identifier and gather host attributes such as OS details, install timestamps, locale/timezone, and directory/file metadata. That kind of anti-abuse fingerprinting capability is not justified by a skill whose manifest says it queries restaurant information and performs queue-number actions through an official API.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The file imports child_process and invokes execSync-based logic in functions that inspect platform-specific system information, including reading Linux/macOS metadata through shell commands. Spawning local commands to profile the runtime host is not an obvious or necessary capability for store lookup, queue status checks, taking a queue number, or canceling a queue.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The module constructs paths under the user's home directory, reads/writes JSON files, uses lock files, and caches a generated local identifier/fingerprint for reuse. Persistent local tracking is unrelated to the manifest's limited restaurant information and queue operations, and introduces a capability to identify users across sessions without that intent being stated.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest describes querying restaurant/shop/menu information and limited real queue actions, but this bundled code primarily implements signing, common-parameter injection, fingerprint generation, and host profiling. While request signing may support API access, the breadth of fingerprinting and local-environment collection materially exceeds what the manifest communicates.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: This file implements a standalone 'pt-passport' command-line tool for Passport authentication, including fetching auth links, polling for approval, caching tokens, and printing tokens to stdout. A dumpling restaurant skill is described as querying store/queue/menu information and performing queue actions; a generic authentication utility is not justified by that purpose.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The file persists tokens under ~/.xiaomei-workspace and stores session state in temporary files, then provides commands to retrieve cached tokens later. Persisting reusable credentials on disk is a sensitive capability that goes beyond the stated restaurant information lookup and queue-management purpose.

Context-Inappropriate Capability

High

Confidence: 92% confidence
Finding: Functions such as printToken/cmdGetToken output bearer tokens directly to stdout or JSON, making credential extraction a first-class capability of this file. Exposing raw auth tokens is not justified by a skill whose stated purpose is restaurant info lookup and queue operations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This markdown file states that the skill can perform real Meituan queue actions, including taking a queue number and cancelling an existing queue order, and even says confirmation leads to automatic booking. However, it does not clearly warn users that these actions affect a live account and may create or cancel real restaurant queue reservations.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: This markdown skill defines invocation keywords such as "饺子", "外卖", "菜单", "自提", and especially natural phrases like "来份饺子" that overlap with common everyday speech. The file does not provide exclusion conditions or a narrower activation scope, so the skill could be invoked unintentionally outside a clear JinGuYuan-specific context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The text states that queries go to an official REST API and notes a phone-based login path, but it does not warn users that their query parameters and potentially phone-linked account data will be sent to a remote service.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This document presents the skill instructions entirely in Chinese, with no indication that users may opt into that language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The instruction says agents should not rely only on '中文自然语言说明', indicating the skill is written to operate in Chinese and assumes Chinese-language interaction. There is no user opt-in, alternative language path, or documented justification that this skill is limited to a Chinese-only locale, which creates a language/locale policy concern.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The code launches a detached background worker with stdio ignored, which changes runtime state outside the immediate command execution. While some returned messages elsewhere mention background polling, this specific safety-critical subprocess launch has no local confirmation prompt, log, or comment clearly warning that a detached child process will continue running independently.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The function automatically deletes matching QR image files older than the configured threshold, which is a destructive filesystem action. There is no local prompt, print/log statement, or nearby comment disclosing to the user that existing files in the target directory may be removed automatically.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: This code unconditionally removes legacy QR filenames when present, which is an irreversible file deletion operation. The deletion is silent in the implementation and lacks a visible prompt, log, or local disclosure that user-accessible files may be removed.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The cleanup routine deletes the owned QR image file after cancellation or success, which is an irreversible filesystem change. Although the behavior is constrained to validated paths, the operation itself is not accompanied by a prompt, print/log statement, or explicit local warning to the user.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script saves authentication tokens and session data to disk using file writes, including a cache file under the user's home directory and session files in a temp directory. Although permissions are tightened with chmod, there is no confirmation prompt or explicit user-facing warning near these persistence operations that sensitive credentials will be stored locally.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Functions in this file output bearer-like tokens directly via stdout and console logs, which can expose credentials through terminal history, logs, or calling process capture. The code does not provide a visible warning to users about the sensitivity of this output before emitting the token.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The script emits user-facing status and error messages in Chinese and formats dates with a fixed 'zh-CN' locale. This imposes a specific language/locale on all users without opt-in or documented justification, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The manifest description is written only in Chinese ("美团 Passport 用户授权登录 CLI 工具"), which imposes a specific language on users without offering any language choice or indicating that the tool is region-specific. Under the stated policy, natural-language content that forces a locale without opt-in should be flagged unless clearly justified.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.obfuscated_code

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/jgy.cjs:22

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/vendor/pt-passport/dist/index.js:2