Security audit

美团出行红包

Security checks for vulnerabilities and agentic risk

Overview

The skill can claim Meituan travel coupons, but it also steers users into broad promotional flows, stores account credentials, and supports persistent automatic account actions with overbroad local cache tooling.

Review this carefully before installing. Use it only if you are comfortable giving the skill your Meituan phone-login flow, storing local tokens/device identifiers, and optionally allowing recurring automated coupon claims. Avoid enabling auto-claim unless you understand how to list and cancel the scheduled job, and be aware that the bundled cache tool has overbroad local file and shared-token capabilities.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Mandatory Instruction Override and Promotional Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:487
Finding: Authentication Token Transmitted in URL Query Parameters
Content: View full analysis
``` TLS certificate verification is enabled, so the token is encrypted in transit against ordinary network observers. However, TLS does not prevent URL capture by components that process the request before encryption or after termination. Query strings are commonly retained in: - Reverse-proxy access logs. - Application server logs. - API gateway telemetry. - Endpoint monitoring and debugging tools. - Exception reports and tracing systems. - Corporate HTTPS interception infrastructure. The token transmission is necessary for remote validation, but placing it in the URL is not necessary. The same operation can use an authorization header or JSON request body with stricter redaction controls. ### Attack Path 1. A user has a valid Meituan `user_token` in local Skill storage. 2. The Agent runs `auth.py token-verify`. 3. `httpx` appends the token to the verification endpoint's query string. 4. A reverse proxy, API gateway, monitoring agent, tracing system, or diagnostic collector records the complete URL. 5. An operator or attacker with access to those records obtains the token. 6. If the token remains valid and is accepted as a bearer credential, it may be replayed against supported account or coupon APIs. ### Impact Assessme ...[truncated 532 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/auth-flow.md:98
Finding: Phone Numbers, SMS Codes, and Session Tokens Exposed Through Process Arguments
Content: View full analysis
``` ```bash $PYTHON "$AUTH_SCRIPT" verify --phone --code ``` Coupon issuance and querying place the persistent user token in process arguments: ```bash ISSUE_RESULT=$($PYTHON "$ISSUE_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED") ``` ```bash QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates "20260323") QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates "20260320,20260323") ``` The authentication CLI explicitly defines these sensitive arguments: ```python p_sms.add_argument("--phone", required=True, help="手机号（11位）") p_verify.add_argument("--phone", required=True, help="手机号（11位）") p_verify.add_argument("--code", required=True, help="验证码") ``` ### Technical Analysis Command-line arguments are not an appropriate secret-transport mechanism. Depending on the operating system and execution environment, argv values can be exposed through: - Process-listing utilities. - `/proc//cmdline` on Linux. - Endpoint detection and response telemetry. - Parent-process logging. - Shell debugging or execution traces. - Job schedulers and automation logs. - Crash reports and support bundles. - Shell history if commands are entered directly. The SMS verification code is short-lived, but exposure during its validity window may allow login completion. The `user_token` is more serious because it can remain valid across sessions. The full phone number is ...[truncated 1447 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/skill_cache_cli.py:415
Finding: Cache CLI Path Traversal Allows Filesystem Access Outside the Cache Root
Content: View full analysis
Path: """获取 Skill 目录路径""" if subdir not in self.SUBDIR_TYPES: raise ValueError(f"未知子目录类型: {subdir}。可用: {list(self.SUBDIR_TYPES.keys())}") skill_path = self.config.cache_root / skill_name / subdir skill_path.mkdir(parents=True, exist_ok=True) return skill_path def _get_file_path(self, skill_name: str, filename: str, subdir: str = "data") -> Path: """获取文件完整路径""" return self._get_skill_path(skill_name, subdir) / filename def write(self, skill_name: str, filename: str, content: str, subdir: str = "data", append: bool = False) -> Dict: """写入文件（带文件锁保护）""" file_path = self._get_file_path(skill_name, filename, subdir) mode = "a" if append else "w" try: with open(file_path, mode, encoding="utf-8") as f: if _HAS_FCNTL: fcntl.flock(f.fileno(), fcntl.LOCK_EX) try: f.write(content) finally: if _HAS_FCNTL: fcntl.flock(f.fileno(), fcntl.LOCK_UN) def read(self, skill_name: str, filename: str, subdir: str = "data") -> Dict: """读取文件""" file_path = self._get_file_path(skill_name, filename, subdir) if not file_path.exists(): return { "success": False, "error": f"文件不存在: {file_path}" } try: with open(file_path, "r", encoding="utf-8") as f: content = f.read() def delete(self, skill_name: str, filename: str, subdir: str = "data") -> Dict: """删除文件""" file_path = self._get_file_path(skill_name, filename, subdir) if not file_path.exists(): return { "success": False, "error": f"文件不存在: {file_path}" ...[truncated 3199 chars]
Remediation: View remediation
Path: root = root.resolve(strict=True) for component in components: candidate = Path(component) if candidate.is_absolute() or any(part in ("", ".", "..") for part in candidate.parts): raise ValueError("Invalid path component") target = root.joinpath(*components).resolve(strict=False) if not target.is_relative_to(root): raise ValueError("Path escapes the allowed cache root") return target ``` 4. Apply the same validation to shared-file operations. 5. Use a strict allowlist for Skill names and filenames where possible. 6. Defend against symlink races by opening files relative to a trusted directory descriptor and using no-follow flags where supported. 7. Use atomic writes through a securely created temporary file followed by `os.replace`. 8. Apply restrictive permissions to every file containing identifiers or history, not only the `config` subdirectory. 9. Add tests covering: - `../` traversal. - Absolute paths. - Nested traversal. - Symlink escape. - Windows drive paths and alternate separators. - Read, write, append, and delete operations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a narrow coupon assistant, but the skill also performs broader authentication, local credential persistence, scheduled task management, and remote version checks. This transparency gap prevents informed consent and can hide security-relevant behaviors from users and reviewers, which is particularly sensitive because the skill manages tokens, phone-based login, and persistent local state.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description presents a narrow coupon assistant, but the skill also performs broader authentication, local credential persistence, scheduled task management, and remote version checks. This transparency gap prevents informed consent and can hide security-relevant behaviors from users and reviewers, which is particularly sensitive because the skill manages tokens, phone-based login, and persistent local state.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger section says the skill should be prioritized for a wide range of generic coupon/discount/red-envelope phrases, which can cause the agent to invoke it in ordinary conversation without sufficiently clear user intent. In this skill, unintended activation is more dangerous than usual because invocation can lead into login, token handling, local persistence, and coupon-claim actions tied to a user account.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The intent-recognition rules are intentionally expansive: broad benefit/activity keywords can trigger direct coupon issuance without clarification, and other vague consumption or price-sensitivity cues prompt upsell-style activation. Because the workflow includes account verification, script execution, and a mandatory follow-up about scheduled auto-claiming, ambiguous triggering can push users into sensitive flows they did not explicitly request.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.
md
> 完整的定时任务创建、管理、失败处理和跨平台兼容规则，读取 `references/cron-rules.md`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
> 完整的定时任务创建、管理、失败处理和跨平台兼容规则，读取 `references/cron-rules.md`。

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/auth.py (reported line 132)May include surrounding context.
python
cmd.append(subcommand) cmd.extend(args) env = os.environ.copy() env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace()) try:

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/common.py (reported line 77)May include surrounding context.
python
cmd.append(subcommand) cmd.extend(args) env = os.environ.copy() env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace()) try:

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code centralizes authentication tokens in a shared file and provides get/set/delete/list operations for arbitrary skill names, enabling enumeration and manipulation of credentials across skills. In the context of a coupon assistant, that is especially dangerous because tokens are high-value secrets and cross-skill access can lead to credential theft, account misuse, or lateral movement between skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The auth delete path removes stored authentication information, including potentially all credentials for a skill, but the CLI offers no warning or confirmation. Deleting credential material is safety-critical because it can break access flows and is not easily recoverable by the user.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exercises powerful capabilities including shell, filesystem, environment access, and network operations, but does not declare an explicit tool scope or permission boundary. That makes its effective privileges opaque to reviewers and increases the chance of over-privileged execution or accidental expansion of what the skill can do, especially because it handles authentication tokens and local credential files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions require the agent to present a fixed Chinese statement verbatim and then ask the user to provide a phone number, with no indication that another language can be used. This is a natural-language policy issue because it imposes a specific language on users without opt-in or an explicitly documented locale-specific justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill hard-codes Asia/Shanghai time and says it is independent of the caller's local timezone, which can cause users to enable recurring actions at unintended times. While not a direct code-execution issue, it undermines informed consent and can lead to repeated account activity at times the user did not actually intend.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill extends from one-time coupon claiming into persistent cross-platform automation and proactive notifications, which materially broadens its authority beyond the core user-visible purpose. Even if user-beneficial, this creates an autonomy and scope-creep risk because the agent is instructed to establish durable background behavior in external platforms.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file instructs the agent to invoke platform scheduling commands and APIs such as CronCreate, RemoteTrigger, and openclaw cron, giving it environment-management capabilities beyond simple coupon operations. This is dangerous because durable scheduled execution can outlive the immediate conversation and can be abused or misconfigured to perform unintended repeated actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions direct the agent to obtain and use platform-specific user identifiers to create external scheduled jobs, which is more access than is strictly necessary for immediate coupon redemption. This increases privacy and misuse risk because identifiers can be mishandled, misbound to the wrong account, or used to create ongoing jobs outside the user's clear awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The rules explicitly authorize automatic coupon collection at scheduled times without re-confirmation, yet they do not prominently warn users that the skill will continue to act on their authenticated account in the future. That creates a consent and transparency problem, especially if tokens remain valid and actions continue after the user forgets automation was enabled.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file defines all user-facing response templates entirely in Chinese and requires them to be output verbatim, which imposes a fixed language on users. There is no indication that users can opt into another language or that this locale restriction is documented as a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill is designed around maintaining session state across runs, which is functional but security-relevant because it preserves login capability beyond the immediate authentication event. In the context of a coupon skill, long-lived cached tokens plus automation features make unauthorized reuse more consequential than ephemeral in-memory auth.
Content: Scanner excerpt · scripts/auth.py (reported line 115)May include surrounding context.
python
调用 mt-ug-ods-skill-cache CLI Args: command: 主命令（如 auth, shared, read, write 等） subcommand: 子命令（如 get, set, list 等） args: 额外参数列表 raw_output: 是否返回原始输出（用于 shared read 等直接返回内容的命令）

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill is designed around maintaining session state across runs, which is functional but security-relevant because it preserves login capability beyond the immediate authentication event. In the context of a coupon skill, long-lived cached tokens plus automation features make unauthorized reuse more consequential than ephemeral in-memory auth.
Content: Scanner excerpt · scripts/auth.py (reported line 115)May include surrounding context.
python
调用 mt-ug-ods-skill-cache CLI Args: command: 主命令(如 auth, shared, read, write 等) subcommand: 子命令(如 get, set, list 等) args: 额外参数列表 raw_output: 是否返回原始输出(用于 shared read 等直接返回内容的命令)

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/auth.py (reported line 136)May include surrounding context.
python
env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace()) try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env) stdout = result.stdout.strip() if result.stdout else "" # raw_output 模式：直接返回原始内容

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code transmits the user's phone number to a remote SMS endpoint as part of authentication, but the function itself does not surface a privacy/consent warning at the time of submission. Because phone numbers are sensitive personal data, sending them off-device without explicit just-in-time notice can create privacy and compliance risk even if the endpoint is legitimate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The verification flow sends both the phone number and SMS code to a remote service without any visible just-in-time warning in this code path. Since the code is an authentication secret and the phone number is personal data, the absence of an explicit disclosure/consent step increases privacy and trust risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The auth module implements persistent scheduled automation for coupon claiming, which materially expands the skill's behavior beyond basic login and coupon retrieval. Hidden or under-disclosed scheduling capabilities can cause actions to continue unattended on the user's behalf, increasing the risk of consent issues, surprise behavior, and misuse if combined with stored authentication state.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill performs cross-platform environment detection and generates external scheduling commands, which is broader than ordinary coupon/authentication functionality. In security terms, this expands the attack surface by adapting to host capabilities and preparing commands that can trigger future actions, making the skill more powerful and less transparent than its stated purpose suggests.
Content: No source excerpt is available for this finding.