ClawHub
Back to skill

Security audit

Meituan Coupon Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Meituan coupon-search purpose, but it bundles live-looking API credentials and under-discloses affiliate/referral link behavior.

Review this before installing: it contacts Meituan services, generates purchase links that may carry referral/CPS attribution, and ships with an embedded API credential. The publisher should remove or rotate the bundled secret and clearly disclose affiliate links and external data sent during searches.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/config.json:2
Finding

Hardcoded Meituan API Credentials

Content
View full analysis

Vulnerability Details

File Location: scripts/config.json, lines 2–3
Vulnerability Type: Hardcoded API credentials and plaintext sensitive data
Risk Level: High

Vulnerable Code

json
{
  "appkey": "4c6b6be3089e4715a080e3edcf60b67c",
  "secret": "13b92efb33c5455bb5d23e6a53ada8b4",
  "host": "https://media.meituan.com",
  "paths": {
    "referral_link": "/cps_open/common/api/v1/get_referral_link",
    "query_coupon": "/cps_open/common/api/v1/query_coupon"
  }
}

Technical Analysis

The project distributes a Meituan API application key and its corresponding HMAC secret in a plaintext configuration file. The secret is not merely sample data: scripts/run.js loads it from config.json and passes it to caSign(), where it is used as the HMAC-SHA256 key for authenticating API requests.

Anyone who can download, inspect, copy, or otherwise access the Skill package can recover the credential without needing elevated local privileges. The attacker can reproduce the documented signing process and submit requests that appear to originate from the legitimate application.

Although the config command masks the secret in its output, this does not protect the underlying value because the complete secret remains directly readable from scripts/config.json.

Attack Path

  1. Obtain a copy of the distributed Skill package or gain read access to its installation directory.
  2. Open scripts/config.json and extract the appkey and secret.
  3. Reproduce the signing algorithm implemented in scripts/run.js, including:
    • JSON serialization of the request body.
    • Calculation of the Base64-encoded MD5 body digest.
    • Construction of the signed headers and canonical string.
    • Generation of the Base64-encoded HMAC-SHA256 signature using the exposed secret.
  4. Send signed HTTPS requests to the configured Meituan coupon-query or referral-link API endpoints.
  5. Continue making req ...[truncated 909 chars]
Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed credential immediately. Treat the current secret as compromised because it has been distributed in plaintext.
  2. Remove all credentials from the Skill package and repository history. Deleting only the current file is insufficient if the value remains in previous commits, archives, releases, build artifacts, or caches.
  3. Load secrets from a protected runtime source, such as:
    • Environment variables supplied by the deployment platform.
    • An operating-system credential store.
    • A managed secret manager with access-control and audit support.
  4. Fail securely when credentials are unavailable. Do not fall back to embedded defaults, example production credentials, or publicly readable files.
  5. Apply least privilege to the replacement credential. Restrict it to only the API operations required for coupon queries and referral-link generation.
  6. Apply provider-side controls where available, including request quotas, rate limits, source restrictions, expiration, and anomaly monitoring.
  7. Review API and affiliate logs for suspicious requests made with the exposed application identity and investigate unexpected usage.
  8. Add automated secret scanning to source-control, packaging, and release pipelines to prevent future credentials from being committed or distributed.
  9. Document secure deployment requirements in SKILL.md without including real secret values.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is presented as a coupon search/comparison tool, but its documented behavior includes generating referral/CPS links and using built-in credentials via a local script. That expands the trust boundary and creates undisclosed commercial redirection and secret-handling behavior, which can mislead users and platform reviewers about what the skill actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates a hidden initialization step and notes that API credentials are built in, while telling the agent not to show this to the user. Silent backend actions reduce transparency and informed consent, and bundled credentials increase the risk of misuse or unauthorized access if the skill package or runtime is exposed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger logic uses very broad phrases and even category-word-only matching, which can activate the skill during ordinary conversation without clear user intent. That can cause unintended API calls, affiliate-link generation, and redirection into a commercial workflow the user did not expressly request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill manifest says this skill is a 美团查券机器人 for searching coupons, discounts, rankings, and price comparisons. In this file, the package description says "美团联盟 CPS 推广助手脚本," which indicates affiliate/CPS promotion functionality rather than coupon lookup, creating a clear semantic mismatch between the declared skill purpose and the packaged code artifact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script reads app credentials from config.json and uses the secret to sign outbound requests, but there is no user-facing warning that local credentials are being accessed and used for remote API authentication. The existing comments are implementation-oriented and do not disclose this behavior to the user at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends request bodies to a remote host via HTTPS, including user-supplied search terms, location fields, product identifiers, URLs, and affiliate parameters assembled later in the file. While the file has comments describing functionality, it does not provide any user-facing prompt, log, or explicit disclosure that these inputs are transmitted off-system to an external API.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill implements promotional/referral link generation even though the declared skill purpose is coupon search, browsing, and price comparison. This is a scope-expansion issue because it enables affiliate attribution and traffic redirection functionality that users may not expect, creating risk of undisclosed monetization, deceptive behavior, and misuse of user-selected products or URLs for promotion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The description, triggers, response scripts, and user-facing prompts are all exclusively in Chinese, with no opt-in, alternative language support, or stated justification that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

User-facing descriptions, command help, and error messages in this file are written exclusively in Chinese, with no indication that another language can be selected. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The header comment says all operations are invoked through the listed subcommands and enumerates init, config, query-coupon, and referral-link. However, the code also implements city-lookup, so the inline documentation does not accurately describe the actual interface and intended operations.

Content

No source excerpt is available for this finding.