Security audit

meituan-travel

Security checks for vulnerabilities and agentic risk

Overview

The skill’s travel purpose is mostly coherent, but it uses sensitive Meituan authentication tokens with unpinned external npm tooling and automatic installs, so it should be reviewed before use.

Install only if you trust the publisher and runtime environment, are comfortable giving this skill Meituan auth access, and can control or pin the npm packages it runs. Avoid using it in broad local environments until the package versions are pinned, automatic global installs are removed, endpoint overrides are restricted, and token injection has clear user consent boundaries.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: meituan-passport-user-auth/reference.md:137
Finding: Remote Node.js installer is piped directly into Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:80
Finding: Authenticated travel workflow executes a mutable latest npm package
Content: View full analysis
" \ --origin-query "<用户完整原始输入>" \ --channel clawh \ [--city <城市>] ``` ### Technical Analysis The primary workflow uses `npx` with the mutable `@latest` tag. The exact code executed can therefore change after the Skill has been reviewed. No exact package version, lockfile, integrity hash, or signature is enforced. The package executes in a security-sensitive context: it receives the Meituan authorization token through `MEITUAN_HT_TOKEN` and receives the user's complete original input through `--origin-query`. A compromised package release, npm account, registry response, or dependency chain could access those values and execute arbitrary code under the Agent's operating-system account. Passing the token to the legitimate travel service is necessary for authenticated queries, but obtaining and executing an unpinned package is not the minimum privilege or trust necessary to perform that function. ### Attack Path 1. An attacker compromises the npm publisher account, registry path, or a transitive dependency and publishes a malicious latest release. 2. A user invokes a travel query. 3. `npx` resolves and executes the package currently identified by `@latest`. 4. The malicious package reads `MEITUAN_HT_TOKEN`, command arguments, local files, or other environment variables. 5. The package exfiltrates data or performs arbitrary actions with the Agent process's permissions. ### Impact Assessment Exploitation could disclose the user's authorization token and complete original query, including unrelated sensitive information contained in the prompt. It could also provide arbitrary code execution with access to all files, credentials, network destinations, and subprocess capabilities a ...[truncated 34 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: meituan-passport-user-auth/scripts/qrcode-image.sh:48
Finding: QR generation automatically installs an unpinned package globally
Content: View full analysis
/dev/null; then echo "[qrcode-image.sh] qrcode 模块未安装，正在自动安装..." >&2 if ! npm install -g qrcode 2>&1 >&2; then echo "QRCODE_SKIP" exit 0 fi NODE_GLOBAL_MODULES="$(npm root -g 2>/dev/null)" ``` ### Technical Analysis If the `qrcode` module is unavailable, the script automatically downloads and globally installs the package without specifying an exact version or verifying its integrity. npm packages and their lifecycle scripts can execute code during installation. The global installation also modifies shared user-level or system-level tooling beyond the duration of the Skill invocation. This exceeds the minimum changes necessary to generate a single QR image and exposes subsequent processes to the installed package. ### Attack Path 1. The local environment does not already contain the global `qrcode` module. 2. The user invokes the authorization workflow. 3. The QR script executes `npm install -g qrcode`. 4. npm resolves the current package version and its dependency graph. 5. A compromised package or dependency executes malicious installation code or leaves malicious globally available modules. 6. The QR script subsequently loads the installed module through `NODE_PATH`. ### Impact Assessment A malicious package can execute with the privileges of the npm invocation, inspect user-accessible files, access environment variables, communicate over the network, and alter global Node.js tooling. The global installation can continue affecting later sessions and unrelated applications that resolve the same module. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: meituan-passport-user-auth/scripts/qrcode-image.sh:18
Finding: Caller-controlled client ID is used in a predictable QR output path
Content: View full analysis
/dev/null | head -c8; true) IMGFILE="$SCRIPT_DIR/qrcode_${RAND}.png" RAND_FILE=1 fi ``` ```bash RESULT=$(NODE_PATH="$NODE_GLOBAL_MODULES" node -e " const qr = require('qrcode'); const file = process.argv[1]; const url = process.argv[2]; qr.toFile(file, url, { type: 'png', width: 300, margin: 2, errorCorrectionLevel: 'M' }, (err) => { if (!err) { process.stdout.write('QRCODE_IMAGE:' + file); } else { process.stdout.write('QRCODE_SKIP'); } }); " -- "$IMGFILE" "$URL" 2>/dev/null) ``` ### Technical Analysis When a client ID is supplied, it is inserted directly into the output filename. The value is not constrained to safe filename characters, canonicalized, or checked for path separators. The output is predictable and is opened by `qr.toFile` without exclusive creation or a symlink check. The predictable client-ID branch also sets `RAND_FILE` to zero, so its output is not removed by the cleanup handler. This leaves authorization QR images in the Skill's script directory after execution. Where an attacker can influence the client ID or create filesystem entries in the relevant directory, path components or a pre-created symbolic link can redirect the PNG write to another user-writable file. ### Attack Path 1. An attacker supplies a crafted client ID or predicts the fixed QR filename. 2. The attacker includes path separators where usable or creates a symbolic link at the expected output path. 3. The authorization workflow invokes `qrcode-image.sh`. 4. `qr.toFile` opens the selected path and writes PNG data. 5. The linked or selected target is overwritten if the Agent account has write ...[truncated 550 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: meituan-passport-user-auth/SKILL.md:64
Finding: User-provided base URL can redirect the authentication workflow
Content: View full analysis
[--env test] [--base_url ] ``` ```bash pt-passport auth poll-token --client_id [--base_url ] ``` The corresponding CLI reference also declares the override: ```markdown | `--base_url` | - | 自定义 API 地址，优先级高于 `--env`（泳道） | ``` ### Technical Analysis The instructions allow a URL supplied through the conversation to override the normal Meituan authentication endpoint. No mandatory HTTPS check, hostname allowlist, IP-address restriction, redirect policy, or administrator-only control is specified. This breaks the expected trust boundary of the authentication process. A user or prompt-injected instruction could direct the CLI to an attacker-controlled service or an internal network address. The absent manifest-declared `pt-passport` package prevented verification of the precise request fields sent by the CLI, so disclosure of any particular secret cannot be asserted; however, redirecting an authentication client to an arbitrary endpoint inherently exposes its request metadata and permits spoofed responses. The override is not required for ordinary production authentication. Internal lane selection, if operationally necessary, should be restricted to administrator-approved Meituan domains. ### Attack Path 1. An attacker causes the conversation to include a malicious `base_url`. 2. The Agent follows the Skill instructions and passes that value to `auth get-code`. 3. The authentication CLI sends authorization requests to the attacker-selected destination. 4. The attacker records request metadata and returns crafted authorization links or pr ...[truncated 704 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user travel concierge skill focused on travel products and planning. The supplied code does not implement any travel-related functionality such as search, booking, pricing, reviews, or itinerary management. Instead, it is an installation script for a local npm package named pt-passport, including environment validation, version detection, and global CLI installation. This is a materially different primary purpose and introduces undeclared system/package-management behavior unrelated to the stated travel assistant description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad travel concierge/booking skill, but the supplied code does not implement any travel-related functionality such as search, booking, price comparison, reviews, or itinerary planning. Instead, it is a utility script for creating QR code PNG files from a URL, storing them locally, and even installing a required npm module globally if absent. That is a materially different purpose and introduces undeclared capabilities related to file creation and package installation. Therefore, the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents this skill as a full-featured Meituan travel concierge handling travel product discovery and planning. However, the supplied code chunk does not implement any travel-related business logic such as searching hotels, flights, trains, tickets, deals, reviews, or itinerary management. Instead, it solely performs account authorization setup: installing/finding a passport CLI, checking cached credentials, requesting authorization links, and generating a QR code for login. While authentication could be a supporting component of a travel skill, this code chunk by itself materially differs from the declared primary purpose and exposes undeclared capabilities related to auth/token handling.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | bash construct creates an immediate command-execution chain from untrusted network content to a local shell. In the context of a skill consumed by agents or users, this increases the chance of blindly executing attacker-controlled code and is particularly dangerous because it normalizes unsafe command-chaining behavior in setup instructions.
Content: Scanner excerpt · meituan-passport-user-auth/reference.md (reported line 137)May include surrounding context.
text
macOS（推荐 nvm）： curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash nvm install 18 Windows：

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is written as an official user-facing instruction in Chinese and presents the skill as the user's travel assistant without indicating any option to use another language. This can constitute a language/locale policy violation because the skill appears to assume a fixed language rather than offering user opt-in or choice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill allows execution via npx without a pinned package version, which can fetch whatever version is current at runtime. This creates a supply-chain risk: a compromised upstream package, malicious update, or unexpected breaking change could execute arbitrary code during auth or query flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill's usage boundaries, prompts, waiting messages, error handling, and output requirements are all specified only in Chinese, with no indication that users may choose another language. For an end-user-facing skill, this reads as a forced locale/language behavior rather than an opt-in or clearly justified regional limitation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The command npx @meituan-travel/ht-ai-open@latest query explicitly tracks latest, guaranteeing unreviewed code updates at execution time. In a skill that handles authentication tokens and user travel queries, this materially increases the risk of supply-chain compromise, token theft, or silent behavior changes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates forwarding the user's complete original input to an external CLI, which may include unnecessary personal data, credentials, health details, or unrelated context beyond the minimum needed for travel search. This violates data minimization principles and creates an avoidable disclosure path to downstream tooling and services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is designed to be automatically invoked whenever another skill command template contains ${passport_token}, with 'Token 透明注入，无需用户感知'. That creates a cross-skill privilege boundary issue: any dependent skill that can declare or inject this placeholder may silently trigger credential acquisition and use a user token without a clear, per-use authorization step.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is designed to be automatically invoked whenever another skill command template contains ${passport_token}, with 'Token 透明注入，无需用户感知'. That creates a cross-skill privilege boundary issue: any dependent skill that can declare or inject this placeholder may silently trigger credential acquisition and use a user token without a clear, per-use authorization step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document states that auth get-code writes a session file under /tmp, but does not describe the sensitivity of its contents or local file-handling risks. Temporary directories are shared attack surfaces on many systems, and predictable or recoverable session artifacts can be read, raced, or retained longer than intended if permissions and cleanup are not tightly controlled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document instructs the LLM to replace ${passport_token} with the real token in the final command before execution. When secrets are embedded directly into command lines or headers, they can be exposed through shell history, process listings, debugging output, agent logs, or downstream tooling, especially in multi-layer agent execution environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically performs npm install -g qrcode at runtime if the module is missing, which changes the host environment and pulls code from the package registry without explicit user approval. In an agent-skill context, this expands the trust boundary from QR generation to package installation and creates supply-chain and persistence risk if the registry, package, or execution environment is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script installs a global npm package without any interactive confirmation or prior user-facing consent, causing unexpected side effects on the system where the skill runs. This is risky because a seemingly simple utility script can mutate the environment, execute package lifecycle scripts, and fetch untrusted external code during normal operation.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The documentation recommends curl ... | bash to fetch and execute a remote installer script directly from GitHub. This pattern bypasses integrity verification and causes arbitrary code execution if the remote content, transport, repository, or user environment is compromised.
Content: Scanner excerpt · meituan-passport-user-auth/reference.md (reported line 137)May include surrounding context.
text
macOS（推荐 nvm）： curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash nvm install 18 Windows：

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script emits a fixed Chinese message (qrcode 模块未安装，正在自动安装...) to users with no language or locale selection. This can violate language/locale policy when the skill is not explicitly documented as Chinese-only or region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code invokes a helper to generate a QR code image and then returns the resulting file path, which implies a local file write. In this script, there is no explicit warning, confirmation, or user-facing disclosure that a file will be created on disk.
Content: No source excerpt is available for this finding.