Security audit

meituan-union-smart-recommendation-skill

Security checks for vulnerabilities and agentic risk

Overview

This Meituan guide skill matches its shopping recommendation purpose, but it needs Review because it handles account tokens and binding secrets while using broad triggers, silent network/setup actions, and global package installs.

Install only if you are comfortable authorizing a Meituan account, storing local tokens and binding code words, and allowing the skill to run setup scripts and network checks. Avoid sharing diagnostic output or the listed token/binding files, and prefer a version with narrower triggers, explicit setup consent, no runtime global npm installs, and redacted diagnostics by default.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The terms claim that login tokens and binding information are stored only on the local device and are not uploaded to any third party, yet the same document describes server-side identity verification, link delivery, interface use, and security monitoring. This creates a likely misleading data-handling statement that can cause users to make unsafe trust decisions and may conceal broader processing of authentication or binding data.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The code comments and docstring state that bind logs are encrypted with a key derived from device_token + aiScene, but the implementation silently falls back to a weaker key derived only from aiScene when device_token is unavailable. That downgrade reduces confidentiality for logged data and can mislead maintainers or auditors into overestimating protection, especially since the log may still contain response bodies and operational metadata.

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger scope is extremely broad, covering many everyday consumption phrases and even vague recommendation requests, while instructing the agent that it 'must' use this skill. In an agent environment, this can cause unintended invocation, unnecessary authentication prompts, and redirection of users into affiliate/commercial flows when they did not explicitly request this skill.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly discloses the filesystem paths of locally stored authentication tokens and binding data, which are sensitive artifacts. Even though this is a troubleshooting guide, exposing exact locations without warning users not to share, copy, or mishandle these files increases the chance of credential leakage through screenshots, pasted logs, support tickets, or local compromise.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The sample invocation phrases are very broad everyday requests such as asking to find takeout or nearby dining, which can overlap with normal conversation and unintentionally trigger the skill. In an agent environment, overly generic triggers increase the chance of accidental activation, unwanted account-linking flows, or unplanned use of a commerce-oriented capability.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script automatically runs `npm install -g qrcode` if the module is missing, without explicit user approval. That mutates the host environment, requires elevated/system-wide package install behavior in many setups, and introduces supply-chain risk from fetching and executing package installation logic during normal script execution. In an agent skill context, silently installing software is more dangerous because it may occur in unattended or privileged automation environments.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/DOCTOR.md:97

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:207