Security audit

meituan-union-coupon-skill

Security checks for vulnerabilities and agentic risk

Overview

This Meituan coupon skill is not plainly malicious, but it needs Review because it handles phone/SMS login, stored tokens, reminders, diagnostics, update commands, and unsafe network settings under broad triggers.

Install only if you trust this publisher and are comfortable giving the skill your Meituan phone number/SMS code and letting it store local login and device identifiers. Review how to fully clear stored credentials, be cautious with the Doctor diagnostics because they can expose raw tokens/log data, and prefer a version that narrows triggers and enables TLS certificate verification for all account-related requests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is marketed as a simple coupon/reminder tool, but the documented behavior includes SMS-based account login, persistent token/device identifier storage, logout/device-reset flows, and remote version checks. This mismatch can mislead users into granting sensitive credentials and local persistence they did not reasonably expect, increasing the risk of privacy harm and unauthorized account actions.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill includes self-update discovery and can invoke platform update commands, which is outside the narrow user expectation of claiming coupons. Executing updates from within the skill expands trust boundaries and can lead to unintended code changes or supply-chain exposure if the remote source or update tool is compromised.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The diagnostic instructions explicitly read a raw user token from a local auth file and pass it as a command-line argument to another script. This exposes a sensitive bearer credential beyond the minimum needed for the stated coupon/reminder functionality, and command-line arguments are often visible to process listings, shell history, logs, and other local tooling.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file implements a full SMS-based authentication flow, persistent user_token storage, and device_token management that materially exceeds the manifest's stated coupon/reminder behavior. This is security-relevant because it collects and persists sensitive authentication artifacts and expands the skill's privilege and data-handling scope without clear necessity or transparent justification in the declared functionality.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code generates a persistent device_token derived from phone-related seed data plus time/randomness and stores it across sessions as a stable device identifier. In the context of a coupon/reminder skill, this creates unnecessary tracking/fingerprinting capability and increases privacy and abuse risk if the token is correlated with phone numbers, tokens, or logs.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This script reads a local auth token file and decrypts authentication logs, exposing sensitive auth workflow data that is unrelated to a coupon/reminder skill's stated purpose. Even though it appears intended for diagnostics, the capability expands access to authentication artifacts and could reveal phone metadata, verification results, or other operational details if run on a user system.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script accesses a credential store in the user's home directory and uses the recovered device token to decrypt local logs. Even though this appears to be for diagnostics, reading unrelated auth material is not justified by the skill's advertised coupon/reminder functionality and creates a capability to access sensitive user-linked data without clear disclosure or isolation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script reads a sensitive device token from the user's local workspace auth file and uses it to derive a log 'encryption' key, even though coupon issuance does not require access to that secret. This creates unnecessary access to unrelated credentials and couples operational logging to local authentication material, increasing the risk of secret misuse, privacy violations, and harder-to-audit behavior.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger list contains broad terms such as '福利', '羊毛', '优惠券', and '今天有什么活动', which can match ordinary conversation and unintentionally launch a flow that asks for consent, login, or reminder setup. Overbroad activation is dangerous here because the skill handles sensitive account authentication and persistent settings rather than harmless informational responses.

Vague Triggers

High

Confidence: 95% confidence
Finding: The intent rules allow activation from general consumption or savings discussion, including ordinary lifestyle queries, and can proactively steer users into coupon or reminder flows. Because the skill can collect phone numbers, initiate SMS verification, and store long-term settings, ambiguous intent matching materially raises the risk of unauthorized or surprising actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill describes scheduled reminders and proactive messages while not prominently warning users that it will store reminder preferences and send future outbound prompts. This can lead to consent confusion and unexpected recurring contact, especially when coupled with broad triggers and long-term memory writes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document instructs retrieval and use of the full token without any warning, consent step, or privacy notice about handling a highly sensitive authentication secret. In the context of a consumer coupon skill, this is especially risky because the token can likely authorize account actions and its handling is not justified or minimized.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger list includes many generic coupon-seeking phrases such as '领券', '优惠券', '福利', and '今日活动', which can easily match ordinary user requests outside a clearly scoped Meituan context. In an agent platform, overly broad triggers can cause unintended skill invocation, increasing the chance of phishing-like redirection, unsolicited coupon flows, or unnecessary collection of phone numbers and verification codes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script directly accesses a device token from a user token file without any visible user-facing notice or consent flow, which is a sensitive-data access pattern. In the context of a consumer coupon skill, silently reading authentication material is unjustified and increases the risk of privacy violations or downstream abuse if the token is reused elsewhere.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code reads a sensitive device token from ~/.xiaomei-workspace/auth_tokens.json without any user-facing notice, consent flow, or strong need tied to the skill's public purpose. Accessing authentication material in this way expands the blast radius of the skill and could expose or enable correlation of protected account activity if the script or surrounding logs are misused.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code accesses a sensitive device token from a local auth file without any user-facing disclosure or necessity for the advertised coupon function. Even if the token is only used indirectly, silent access to unrelated credentials violates least-privilege expectations and can enable secret exposure or abuse if the code is modified, logged, or reused elsewhere.

Static analysis

Detected: suspicious.insecure_tls_verification, suspicious.secret_argv_exposure

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/auth.py:334

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/DOCTOR.md:123

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:161