Security audit

美团出行红包

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real coupon helper, but it needs review because it stores Meituan login tokens locally in shared cache storage and can create recurring automatic coupon-claim jobs.

Install only if you can verify the publisher is genuinely associated with Meituan. Before entering a phone number or SMS code, understand that reusable login and device tokens are stored locally and may be kept across sessions in shared cache storage. Enable daily auto-claiming only if you want recurring account actions, and use the logout, clear-device-token, and cancel-auto-claim flows when you stop using it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell, reads environment variables, accesses local files, writes persistent auth/coupon data, and calls remote services, yet the manifest does not explicitly declare these capabilities. This creates a transparency and consent gap: a host agent or reviewer may treat the skill as lower-risk than it really is, while the skill handles tokens, device identifiers, phone-related data, and network operations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The advertised behavior is coupon claiming and history lookup, but the skill also performs additional stateful and potentially sensitive actions: agreement tracking, version checks, device-token lifecycle management, local cache manipulation, and scheduled automation. This mismatch undermines informed consent and increases the attack surface because users and orchestrators may trigger functionality they did not reasonably expect from the description.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill introduces recurring cron-based coupon automation even though the manifest describes an on-demand assistant. Persistent scheduled execution is materially more sensitive than a one-shot user request because it can continue making network calls and changing local state after the original interaction, potentially surprising users or being abused for unauthorized repeated actions.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file expands a one-time coupon-claiming skill into a persistent automation system that creates scheduled jobs and sends follow-up notifications. That materially changes the trust boundary and operational scope of the skill, increasing the risk of unintended ongoing actions, surprise execution, and repeated access to account-linked functionality beyond a single user request.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The instructions direct the agent to obtain and use platform-specific user identifiers to create cross-platform scheduled delivery jobs. Even if operationally useful, collecting and embedding user IDs in scheduling commands creates unnecessary identifier handling risk unless it is minimized, justified, and disclosed to the user.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The scheduled flow explicitly performs token verification, coupon issuance, and user notification automatically at a later time without renewed confirmation. This creates an autonomous action path that can continue using previously granted access and may surprise users or operate after circumstances change, especially if tokens remain valid or state becomes inconsistent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This code implements shared authentication-token storage in a global .shared area accessible across skill namespaces, which is far broader than the advertised coupon-retrieval functionality. In a multi-skill agent workspace, any skill or operator with access to this CLI can read, overwrite, or delete tokens for other skills, enabling credential theft, impersonation, or account/session disruption.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The shared_read/shared_write/shared_delete APIs provide arbitrary file management in a cross-skill shared directory, not just coupon-related state. That creates an overprivileged capability surface where one skill can inspect or tamper with data used by others, breaking isolation and enabling data leakage or cross-skill state poisoning.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This CLI exposes generic local file-management operations for arbitrary skill names, directories, JSON paths, line editing, cleanup, and introspection. In the context of a travel-coupon assistant, that is an unnecessary and dangerous expansion of authority that can be abused to read, modify, or delete local state for unrelated skills and potentially interfere with the broader agent workspace.

Vague Triggers

High

Confidence: 92% confidence
Finding: The invocation logic is broad enough to trigger on generic bargain-seeking or activity-related language, not just explicit requests for this skill. Overbroad triggering can cause unintended execution of login prompts, coupon issuance flows, or follow-up persuasion in contexts where the user did not intend to interact with this Meituan skill, creating consent and privacy risks.

Vague Triggers

High

Confidence: 93% confidence
Finding: The manifest includes very generic invocation phrases such as '领券' and '领权益' plus a catch-all for any Meituan travel coupon need, which can overlap with many unrelated coupon contexts. That makes accidental routing and unintended skill activation more likely, especially in multi-skill environments where broad keywords can hijack user requests.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The user-facing prompt emphasizes convenience but does not adequately warn that the agent will keep acting on the user's behalf on a recurring basis and use account state, tokens, and notification channels over time. That weakens informed consent for ongoing autonomous behavior and may lead users to enable persistent actions without understanding the data use and execution model.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Forcing all scheduled jobs to use Asia/Shanghai regardless of the caller's locale can cause misaligned execution times and misleading expectations, especially for users outside China. While not a direct security exploit, it is a trust and consent problem because the automation may run at times the user did not actually intend.

Static analysis

No suspicious patterns detected.