Security audit

meituan-union-coupon-skill

Security checks for vulnerabilities and agentic risk

Overview

This Meituan coupon skill matches its advertised purpose, but it under-discloses and insecurely handles account credentials and reminder/update behavior.

Install only if you are comfortable giving this skill your Meituan phone number, SMS code, and account token for coupon claiming. The reviewed version should not be treated as low-risk: it makes misleading local-only privacy statements, disables TLS checks on some auth requests, exposes tokens in script output/arguments, keeps decryptable logs, and can set reminders or run update/diagnostic flows. Prefer a version that fixes credential redaction, TLS verification, logging, update scoping, and accurate consent text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:27
Finding: Agent instruction hijacking and mandatory promotional output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auth.py:325
Finding: TLS certificate verification disabled during sensitive authentication requests
Content: View full analysis
Remediation: View remediation
`, or a protected request body if required by the API. 4. Add automated tests that fail when an authentication request uses `verify=False`. 5. Consider certificate pinning only if the endpoint operator can support safe key rotation. 6. Review server and proxy logging to remove any previously retained token-bearing URLs. 7. Revoke or rotate tokens that may have traversed untrusted networks while certificate verification was disabled. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auth.py:625
Finding: Authentication credentials exposed through standard output and process arguments
Content: View full analysis
``` ### Technical Analysis Standard output is frequently captured by Agent transcripts, orchestration telemetry, shell logs, CI systems, or debugging tools. Command-line arguments may be visible through process-inspection interfaces and may be retained by shell history or execution telemetry. The diagnostic workflow directly contradicts the Skill's stated rule that ...[truncated 1246 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auth.py:165
Finding: Raw authentication and API responses stored with reversible weak encryption
Content: View full analysis
str: device_token = _get_device_token() if device_token: seed = device_token + ai_scene flag = "1" else: seed = ai_scene flag = "0" key_bytes = hashlib.sha256(seed.encode()).digest() data_bytes = data.encode("utf-8") result = bytes(b ^ key_bytes[i % 32] for i, b in enumerate(data_bytes)) return flag + ":" + result.hex() ``` Authentication responses are recorded before their sensitive contents are parsed: ```python resp = httpx.post( url, params={"token": user_token}, headers={ "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1", "X-Requested-With": "XMLHttpRequest", }, timeout=10, verify=False, trust_env=False ) log_entry["response"] = {"http_status": resp.status_code, "body": resp.text[:500]} resp_data = resp.json() ``` Coupon-response logging uses the same pattern: ```python def write_log(entry: dict, ai_scene: str = ""): try: _LOG_FILE.parent.mkdir(parents=True, exist_ok=True) raw = json.dumps(entry, ensure_ascii=False) encrypted = _xor_encrypt(raw, ai_scene) if ai_scene else raw with open(_LOG_FILE, "a", encoding="utf-8") as f: f.write(encrypted + "\n") except Exception: pass ``` The diagnostic tool reconstructs the key and prints the decrypted record: ```python def decrypt(line: str, device_token: str, ai_scene: str) -> dict: flag, hex_data = line.split(":", 1) ...[truncated 2144 chars]
Remediation: View remediation

other

Error

Location: SKILL.md:102
Finding: Mandatory privacy statement contradicts actual remote transmission of sensitive data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/DOCTOR.md:114
Finding: Diagnostic workflow performs a state-changing live coupon claim
Content: View full analysis
``` The procedure requires the raw response to be displayed: ```text 展示原始 JSON 返回，不套用话术模板，直接给用户看原始数据。 ``` ### Technical Analysis A diagnostic workflow should normally use read-only health checks, authentication validation, or a documented dry-run operation. Here, diagnostics call the same state-changing coupon endpoint used by the normal issuance workflow. The live call can consume the account's daily claim or otherwise modify account state. Triggering general diagnostics does not necessarily establish informed consent to claim a coupon. Reading and printing the live token additionally expands credential exposure, as covered by the separate sensitive-output finding. ### Attack Path 1. An authenticated user requests the specifically documented distribution diagnostic operation. 2. The Agent follows `DOCTOR.md`. 3. The workflow reads and prints the user's live token. 4. The Agent invokes `issue.py` with that token. 5. `issue.py` calls the production coupon-distribution endpoint. 6. A coupon is claimed, or the account's daily issuance state is consumed, even though the user requested diagnostics rather than issuance. ### Impact Assessment The diagnostic operation can alter the user's remote account state and may consume a once-per-day coupon opportunity. Its scope is limited to the coupon permissions available to the token, but it exceeds the minimum privileges necessary for netwo ...[truncated 101 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/DOCTOR.md:25
Finding: Diagnostic instructions install an unpinned third-party dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises direct-link navigation, reminders, and richer promotion discovery, while the described implementation appears to rely mainly on API-returned fields and undeclared local logging/token-file access. This mismatch matters because users cannot accurately assess what the skill really does versus what data it consumes locally.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises direct-link navigation, reminders, and richer promotion discovery, while the described implementation appears to rely mainly on API-returned fields and undeclared local logging/token-file access. This mismatch matters because users cannot accurately assess what the skill really does versus what data it consumes locally.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises direct-link navigation, reminders, and richer promotion discovery, while the described implementation appears to rely mainly on API-returned fields and undeclared local logging/token-file access. This mismatch matters because users cannot accurately assess what the skill really does versus what data it consumes locally.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill advertises direct-link navigation, reminders, and richer promotion discovery, while the described implementation appears to rely mainly on API-returned fields and undeclared local logging/token-file access. This mismatch matters because users cannot accurately assess what the skill really does versus what data it consumes locally.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises direct-link navigation, reminders, and richer promotion discovery, while the described implementation appears to rely mainly on API-returned fields and undeclared local logging/token-file access. This mismatch matters because users cannot accurately assess what the skill really does versus what data it consumes locally.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very broad everyday phrases such as generic coupon, activity, welfare, or savings terms, which can cause unintended activation in unrelated conversations. Because activation can lead into login prompts, local token handling, network calls, and reminder setup, accidental invocation has meaningful privacy and consent implications.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The intent rules use broad semantic matching around consumption, discounts, and covered categories, making it easy for ordinary shopping or dining queries to be reinterpreted as coupon-claim intents. In a skill that handles authentication and persistent reminders, this increases the chance of non-consensual or confusing entry into sensitive flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions direct retrieval and use of the complete user_token without any warning, masking requirement, or handling restriction. Full bearer-style tokens are highly sensitive; exposing them in commands, shell history, logs, process lists, or model-visible output can enable account takeover or unauthorized API use.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool/permission scope despite instructing use of shell execution, local file read/write, environment variables, and outbound network access. This weakens sandboxing and user review because the real capability surface is broader than the manifest communicates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instruction requires replies to be exactly the wording defined in SKILL.md, with no additions or rewrites. Because all prescribed user-facing content is in Chinese and no language choice or opt-in is offered, the skill imposes a fixed language/locale behavior on users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes self-update checks and possible update/install actions via external platforms, which are outside the core advertised coupon function. Self-update logic expands supply-chain risk because it can introduce new code paths or fetch artifacts from remote services during normal user interactions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest frames the skill as a coupon领取、活动发现和自动提醒 tool. In addition to expected login support, it exposes explicit logout and device-token reset operations that alter stored authentication state and local device binding, which are broader account-management capabilities not mentioned in the manifest description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Doctor mode executes an external diagnostic playbook unrelated to the main coupon purpose, creating an additional execution surface that may access local state or perform privileged troubleshooting actions. Even if manually triggered, hidden diagnostic paths are risky when they are not part of the declared functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The diagnostic flow explicitly instructs the agent to read a locally stored user_token from disk and pass it to issue.py, which expands the skill from coupon assistance into credential handling and privileged API invocation. Even though framed as troubleshooting, this creates a pathway for sensitive token access and reuse that is unnecessary for normal conversational behavior and increases the chance of credential exposure or misuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document authorizes reading local credential storage and showing raw JSON/API responses directly to the user, which is broader than the stated coupon/reminder purpose and risks exposing secrets, identifiers, internal error details, or backend behavior. Diagnostic documentation is still executable guidance to the agent, so this materially increases the attack surface and data leakage risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a user-facing coupon collection, activity link, and reminder skill, but this file implements a full embedded authentication subsystem for SMS login, persistent user_token/device_token management, and token verification. While some auth may support the skill, the manifest does not disclose that the skill manages account authentication state and device identifiers as a core behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The version-check logic points users to a different external skill page than the manifested skill identity, creating an integrity and trust-boundary problem. In a security-sensitive authentication module, directing update checks to another skill page can facilitate user confusion, supply-chain mix-ups, or social-engineering-driven installation of unintended code.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: The token verification request disables TLS certificate verification with verify=False while transmitting an authentication token to a remote endpoint. This allows a man-in-the-middle attacker on the network path to intercept or tamper with the request/response, potentially stealing the user token, forging token-validity responses, or altering authentication state.
Content: Scanner excerpt · scripts/auth.py (reported line 334)May include surrounding context.
python
"X-Requested-With": "XMLHttpRequest", }, timeout=10, verify=False, trust_env=False ) log_entry["response"] = {"http_status": resp.status_code, "body": resp.text[:500]}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The send-sms flow sends the full phone number in an HTTP request body to a remote endpoint, which is a privacy-relevant network transmission. Although the function docstring says it sends a verification code, there is no explicit user-facing warning, confirmation, or disclosure that the phone number will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 99% confidence
Finding: The SMS-code send request also disables TLS certificate verification with verify=False while transmitting the user's phone number and device identifier. An active network attacker could intercept sensitive personal data, manipulate server responses, or redirect the authentication flow, which is especially dangerous in an account-login module.
Content: Scanner excerpt · scripts/auth.py (reported line 439)May include surrounding context.
python
"X-Requested-With": "XMLHttpRequest", }, timeout=10, verify=False, trust_env=False ) log_entry["response"] = {"http_status": resp.status_code, "body": resp.text[:500]}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The verify command sends both the user's phone number and SMS verification code to a remote endpoint and then stores the returned token locally. The code documents the mechanics in comments/docstrings, but it does not provide a clear user-facing warning that sensitive authentication data will be transmitted and a token persisted on disk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This script reads a local auth token file and decrypts authentication logs, exposing sensitive operational data such as masked phone numbers, verification actions, result codes, and HTTP status. Even though it appears framed as a diagnostic utility, that capability is not aligned with the advertised coupon/reminder functionality, and the weak XOR-plus-hash scheme means anyone with local access and the config/token files can recover log contents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script reads local authentication material from ~/.xiaomei-workspace/auth_tokens.json and uses the device_token as part of the key material to decrypt stored logs. Even though it does not exfiltrate the token directly, this creates an unnecessary capability to access sensitive local auth context that is not aligned with the advertised coupon/reminder functionality, increasing the blast radius if the skill or its diagnostics are abused.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script decrypts the issue log and prints the latest entry in cleartext, which can expose internal diagnostic data, request details, identifiers, or other sensitive contents to anyone with local execution access. In the context of a consumer coupon skill, this debugging capability is out of scope and makes accidental disclosure or misuse more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script reads a separate device token from ~/.xiaomei-workspace/auth_tokens.json solely to derive a log-encryption key, even though that credential is unrelated to the coupon-issuance function. Accessing an additional sensitive token without user disclosure expands the skill’s privilege boundary and creates unnecessary coupling to local secrets; if the log file or code path is abused, this can facilitate hidden tracking or misuse of unrelated credentials.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification, suspicious.secret_argv_exposure

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/auth.py:334

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/DOCTOR.md:123

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:161