Security audit
Security checks across malware telemetry and agentic risk
This skill appears to perform Meituan coupon tasks, but it also handles account tokens, persistent automation, and background update code in ways users should review carefully before installing.
Install only if you trust this publisher and are comfortable granting Meituan login-token handling, local/shared credential storage, optional cross-session token memory, a background Node signing/update component, and daily scheduled account actions. Prefer the --auto flow, avoid agent-memory token storage unless you explicitly want it, review or disable cron jobs, and clear both login and device tokens when you stop using the skill.
env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace())
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
stdout = result.stdout.strip() if result.stdout else ""
# raw_output 模式：直接返回原始内容# 默认检测 openclaw 命令是否存在
try:
result = subprocess.run(
["which", "openclaw"],
capture_output=True,
timeout=2env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace())
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
stdout = result.stdout.strip() if result.stdout else ""
if raw_output:if is_windows:
DETACHED_PROCESS = 0x00000008
CREATE_NEW_PROCESS_GROUP = 0x00000200
subprocess.Popen(
['node', _CLIGUARD_WRAPPER_PATH, '--start'],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,env=env,
)
else:
subprocess.Popen(
['node', _CLIGUARD_WRAPPER_PATH, '--start'],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,"const r=addCommonParams(" + json.dumps(url_str) + ");"
"console.log(r.url)"
)
result = subprocess.check_output(['node', '-e', js_code], timeout=5, stderr=subprocess.PIPE)
injected = result.decode('utf-8').strip()
return injected if injected else url_str
except Exception as e:f"const {{signRequest}}=require({json.dumps(_CLIGUARD_PATH)});"
f"console.log(JSON.stringify(signRequest({json.dumps(method.upper())},{json.dumps(url_str)},{json.dumps(body_hash)})))"
)
result = subprocess.check_output(
['node', '-e', js_code],
timeout=5,
stderr=subprocess.PIPE,f"const {{signRequest}}=require({json.dumps(_CLIGUARD_PATH)});"
f"console.log(JSON.stringify(signRequest({json.dumps(method.upper())},{json.dumps(url_str)},{json.dumps(body_hash)})))"
)
result = subprocess.check_output(
['node', '-e', js_code],
timeout=5,
stderr=subprocess.PIPE,65/65 vendors flagged this skill as clean.
Detected: suspicious.secret_argv_exposure