Security audit

美团优惠领取工具

Security checks for vulnerabilities and agentic risk

Overview

This coupon skill handles Meituan login tokens, local account state, and recurring coupon automation, but its bundled cache and credential tools are broader than the coupon purpose and need review before installation.

Install only if you trust the publisher and are comfortable giving the skill a Meituan login flow, persistent local token/device storage, coupon history files, and optional daily automated coupon claims. Review or disable the bundled generic cache/credential CLI before use in an environment with other skills, and avoid installing where command output, process arguments, or local cache files may be logged or shared.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:27
Finding: Forced promotional output and recurring-task behavior override normal Agent goals
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:390
Finding: Privacy disclosure does not clearly disclose required remote transmission of authentication data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auth.py:487
Finding: Reusable authentication tokens are exposed through process arguments, URL parameters, and standard output
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/auth.py:58
Finding: Environment-controlled interpreter and cache CLI permit local tool substitution
Content: View full analysis
Path: env_path = os.environ.get("SKILL_CACHE_CLI_PATH") if env_path: return Path(env_path) return Path(__file__).parent / "skill_cache_cli.py" def _get_python_exe() -> str: env_python = os.environ.get("SKILL_CACHE_PYTHON") if env_python: return env_python return sys.executable CLI_PATH = _get_cli_path() PYTHON_EXE = _get_python_exe() ``` The selected tools are executed directly: ```python cmd = [PYTHON_EXE, str(CLI_PATH), command] if subcommand: cmd.append(subcommand) cmd.extend(args) env = os.environ.copy() env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace()) result = subprocess.run( cmd, capture_output=True, text=True, timeout=30, env=env ) ``` ### Technical Analysis The implementation trusts `SKILL_CACHE_CLI_PATH` and `SKILL_CACHE_PYTHON` without validating ownership, permissions, location, or integrity. An attacker who can influence the Skill's environment can replace either the interpreter or cache helper with an arbitrary executable. Authentication files and serialized token data are passed through this helper during read and write operations. A substituted tool can therefore capture credentials, return forged authentication state, corrupt cache data, or execute arbitrary local code with the Agent process's privileges. This also contradicts the documentation's claim that Skill scripts and parameters cannot be externally overridden. ### Attack Path 1. An attacker gains the ability to set environment variables for the Agent or Skill process. 2. The attacker sets `SKILL_CACHE_PYTHON` to a malicious executable or `SKILL_CACHE_CLI_PATH` to a malici ...[truncated 838 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/skill_cache_cli.py:270
Finding: Cross-Skill authentication store lacks caller authorization
Content: View full analysis
Dict: result = self.shared_read("mt_auth_tokens.json") if not result["success"]: if "not found" in result.get("error", ""): return { "success": True, "skill": skill_name, "data": {}, "found": False } return result try: data = json.loads(result["content"]) skill_data = data.get(skill_name, {}) if key: return { "success": True, "skill": skill_name, "key": key, "value": skill_data.get(key), "found": key in skill_data } return { "success": True, "skill": skill_name, "data": skill_data, "found": bool(skill_data) } ``` The CLI accepts an arbitrary Skill name supplied by the caller: ```python auth_get = auth_subparsers.add_parser("get", help="Get authentication information") auth_get.add_argument("skill", help="Skill name") auth_get.add_argument("--key", "-k", help="Specific key") ``` ### Technical Analysis The cache file is deliberately shared across Skills, but the CLI does not authenticate the calling Skill or verify that it is authorized to access the requested entry. The `skill_name` parameter is treated only as a lookup key. Any sibling Skill or local process running under the same operating-system account can request the authentication entry of another Skill. The same interface also exposes token replacement and deletion operations. Operating-system file permissions of `0600` protect against other OS users, ...[truncated 909 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/skill_cache_cli.py:166
Finding: Cache path construction permits directory traversal and history files lack documented restrictive permissions
Content: View full analysis
Path: shared_path = self.config.cache_root / ".shared" shared_path.mkdir(parents=True, exist_ok=True) return shared_path / filename ``` Private paths similarly accept unvalidated Skill and file names: ```python def _get_skill_path(self, skill_name: str, subdir: str = "data") -> Path: if subdir not in self.SUBDIR_TYPES: raise ValueError( f"Unknown subdirectory type: {subdir}" ) skill_path = self.config.cache_root / skill_name / subdir skill_path.mkdir(parents=True, exist_ok=True) return skill_path def _get_file_path( self, skill_name: str, filename: str, subdir: str = "data" ) -> Path: return self._get_skill_path(skill_name, subdir) / filename ``` Permissions are explicitly hardened only for configuration files: ```python if subdir == "config": self._set_secure_permissions(file_path) ``` ### Technical Analysis Path components are concatenated without rejecting absolute paths, path separators, or `..` components. A caller of the generic CLI can therefore construct a path outside the intended shared or Skill-specific cache directory. In addition, history files are written under the `data` subdirectory, but the explicit `0600` permission helper is only applied to `config` files. Their effective permissions consequently depend on the process umask, contrary to the documentation's claim that both history files are set to `0600`. ### Attack Path 1. An attacker obtains the ability to invoke the bundled cache CLI under the Agent account. 2. The attacker supplies a filename such as ...[truncated 855 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:854
Finding: Device-token clearing can retain authentication data in a nested cache entry
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a coupon assistant but also specifies broad local file manipulation and token lifecycle handling, including deletion and shared cache management. When a skill's declared purpose hides credential and filesystem management, users and enforcement systems may underestimate the risk of local data exposure, tampering, or destructive actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill presents itself as a coupon assistant but also specifies broad local file manipulation and token lifecycle handling, including deletion and shared cache management. When a skill's declared purpose hides credential and filesystem management, users and enforcement systems may underestimate the risk of local data exposure, tampering, or destructive actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill presents itself as a coupon assistant but also specifies broad local file manipulation and token lifecycle handling, including deletion and shared cache management. When a skill's declared purpose hides credential and filesystem management, users and enforcement systems may underestimate the risk of local data exposure, tampering, or destructive actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a coupon assistant but also specifies broad local file manipulation and token lifecycle handling, including deletion and shared cache management. When a skill's declared purpose hides credential and filesystem management, users and enforcement systems may underestimate the risk of local data exposure, tampering, or destructive actions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list is extremely broad, including generic terms like '领券', '红包', '神券', and other common saving-related phrases, which can cause the skill to activate in conversations where the user did not intend to invoke Meituan account-linked actions. Because the skill can lead into authentication, credential use, network requests, and coupon issuance, accidental invocation has meaningful privacy and action-execution consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent-recognition rules activate on broad semantic patterns such as general saving intent, price dissatisfaction, or future consumption scenarios across many categories. In context, this is more dangerous because the skill is not merely informational; it can initiate login prompts, consume stored tokens, contact remote services, and potentially schedule recurring behavior after a loose semantic match.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
md
> 完整的定时任务创建、管理、失败处理和跨平台兼容规则，读取 `references/cron-rules.md`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
> 完整的定时任务创建、管理、失败处理和跨平台兼容规则，读取 `references/cron-rules.md`。

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The verification flow transmits a phone number and SMS code to a remote service and then stores the returned authentication token locally for reuse. This handles highly sensitive authentication material, and without a clear user-facing warning/consent and stronger storage controls, compromise of the local cache or misuse by the skill can expose persistent account access.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/auth.py (reported line 132)May include surrounding context.
python
cmd.append(subcommand) cmd.extend(args) env = os.environ.copy() env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace()) try:

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/common.py (reported line 77)May include surrounding context.
python
cmd.append(subcommand) cmd.extend(args) env = os.environ.copy() env.setdefault("SKILL_CACHE_WORKSPACE", _get_workspace()) try:

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file implements a generic local cache and cross-skill token/file management utility, which is far broader than the declared coupon-claiming and history-query functionality. In this skill context, that mismatch is dangerous because it creates an unexpected administrative surface that can be used to inspect, modify, or persist unrelated data under the guise of a narrowly scoped coupon tool.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The shared_read/shared_write/shared_delete APIs allow arbitrary access to files in a cross-skill shared directory, with caller-controlled filenames and no authorization checks. That enables one skill or operator context to read, overwrite, or delete data intended for other skills, violating isolation and potentially exposing secrets or corrupting shared state.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The auth_get/auth_set/auth_delete/auth_list functions manage authentication tokens for arbitrary skill names in a globally shared mt_auth_tokens.json file. In a coupon skill, this is especially risky because it centralizes credential material across skills and exposes read/write/delete operations without any boundary tying access to the current skill only.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code exposes generic per-skill CRUD, JSON mutation, and line-editing primitives over caller-supplied skill names and filenames, effectively acting as a multi-tenant file manipulation tool. This exceeds the manifest's purpose and can be abused to tamper with other skills' cached data, configs, or logs, undermining integrity and confidentiality across the workspace.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly instructs use of shell execution, environment variables, local file reads/writes, and networked Python scripts, yet it declares no explicit tool scope or permissions boundary. That makes the actual capability envelope opaque to the host agent and reviewers, increasing the risk of over-privileged execution, unintended side effects, and abuse if the skill is invoked in the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instructions require replies to match predefined script text exactly, and the entire skill content is Chinese-only. This effectively enforces a specific language/locale presentation without giving the user an option to choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains fixed user-facing prompts in Chinese for the authentication flow, and the document overall prescribes Chinese-only interaction text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Forcing all scheduled tasks to use Asia/Shanghai regardless of caller locale can cause the automation to run at times the user did not intend. This is primarily a consent and usability risk, but it can indirectly trigger unexpected account activity and reduce user trust.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file expands the skill from immediate coupon claiming into persistent scheduled automation that creates platform-level cron jobs and sends future notifications. Even if user-consented in some paths, this materially broadens the operational scope beyond the core manifest and increases the chance of unintended autonomous actions, stale consent, and surprise background execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions direct the system to automatically execute future coupon claims at the scheduled time without renewed confirmation. This creates ongoing autonomous actions using saved authentication state, which can outlive user intent and lead to unexpected account activity or notification spam.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Although the file mentions asking the user about scheduling earlier in the flow, the automatic future execution path itself is not accompanied by strong, persistent warning language about ongoing autonomous actions and notifications. Users may not fully understand that the skill will continue acting on their behalf and notifying them later.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document instructs the skill to create, update, and delete platform-level scheduled jobs and remote triggers across multiple environments. Those capabilities exceed basic coupon retrieval and introduce privileged orchestration behavior that can be misused, especially if job IDs, platform detection, or user identifiers are handled incorrectly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction requires all response templates to be output exactly as written, and the templates are entirely in Chinese. This effectively imposes a fixed language on users without offering opt-in, choice, or a documented region-specific justification in this file.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/auth.py (reported line 115)May include surrounding context.
python
调用 mt-ug-ods-skill-cache CLI Args: command: 主命令（如 auth, shared, read, write 等） subcommand: 子命令（如 get, set, list 等） args: 额外参数列表 raw_output: 是否返回原始输出（用于 shared read 等直接返回内容的命令）

Static analysis

No suspicious patterns detected.