Security audit

获取外卖优惠券（隐藏券、大额券）

Security checks for vulnerabilities and agentic risk

Overview

This takeout-coupon skill is purpose-aligned and low impact, but its remote API host and unpinned package installs should be reviewed before use.

Install only if you are comfortable with the skill contacting a third-party coupon gateway and installing Python packages from package managers. Prefer running it in a normal unprivileged environment, and the publisher should pin dependencies, remove unused dependency declarations, and disclose the remote host in the markdown.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned and Unnecessary Third-Party Dependencies Increase Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12–16 **Vulnerability Type**: Unpinned and unnecessary package installation **Risk Level**: Medium ### Vulnerable Code ```json {"id": "uv-pip", "kind": "pip", "formula": "uv", "bins": ["uv"], "label": "Install uv (pip)"}, {"id": "pip-aiohttp", "kind": "pip", "formula": "aiohttp", "label": "Install aiohttp (pip)"}, {"id": "pip-argparse", "kind": "pip", "formula": "argparse", "label": "Install argparse (pip)"}, {"id": "pip-PyYAML", "kind": "pip", "formula": "PyYAML", "label": "Install PyYAML (pip)"}, ``` ### Technical Analysis The Skill installs Python packages by mutable package names without pinning reviewed versions or validating package hashes. Consequently, future installations may resolve to package releases that differ from those available when the Skill was audited. The declared dependency set is also broader than the implementation requires: - `argparse` is part of Python's standard library and does not need to be installed from PyPI. - `PyYAML` is not imported or used by `scripts/route.py`. - Installing these unnecessary packages creates avoidable opportunities for package installation hooks or dependency code to execute. - `uv` and `aiohttp` are installed without exact versions or integrity hashes. No evidence in the audited project proves that the currently resolved packages are malicious. The vulnerability is the unsafe dependency-resolution policy and unnecessary expansion of the supply-chain trust boundary. ### Attack Path 1. A user installs or invokes the Skill in an environment where its declared installation instructions are processed. 2. The package manager resolves `uv`, `aiohttp`, `argparse`, or `PyYAML` from the configured package index without enforcing an audited version and hash. 3. An attacker compromises a package, its maintainer account, the configured package index, or another component in the dependency-resolution chain. 4. The package manager downloads ...[truncated 1074 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `pip-argparse` declaration because `argparse` is included in supported Python versions. 2. Remove `pip-PyYAML` because the audited script does not import or use it. 3. Pin `uv` and `aiohttp` to explicitly reviewed versions rather than resolving unconstrained latest releases. 4. Use a lockfile that records exact transitive dependency versions. 5. Require cryptographic hashes for downloaded distributions, such as through a hash-locked requirements file. 6. Prefer a trusted, controlled package index and enforce TLS certificate validation. 7. Regularly scan locked dependencies for known vulnerabilities and review updates before changing pinned versions. 8. Run dependency installation and the Skill itself as an unprivileged user in an isolated environment with only the filesystem and network access required for coupon retrieval. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The markdown describes the skill's purpose in general terms but does not define specific activation phrases, scope limits, or exclusion conditions. This makes it unclear when the skill should activate versus when a general conversation about takeout coupons should not invoke it.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The docstring for get_eleme_coupon says it calls a flash-sale coupon API, which implies behavior distinct from the Meituan/takeout flow. However, the implementation performs a GET to the exact same /coupon/takeout endpoint used by get_meituan_coupon, so the inline documentation actively misrepresents what the function does.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The function signature and docstring suggest obtain_coupon routes coupon retrieval based on inputs such as source, while the comment says all platforms use a unified interface. In reality, the implementation discards keyword, source, and page and always returns get_meituan_coupon(), which contradicts the stated intent of parameter-driven coupon retrieval.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The skill content is primarily presented in Chinese for interacting with Chinese platforms, but it does not explicitly offer the user a language or locale choice. Under the policy, language constraints should be opt-in or clearly justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The code includes Chinese-language docstrings and descriptions such as the coupon-fetching operation names, but there is no indication that the skill offers a language or locale choice. This can be a natural-language policy issue if the skill effectively assumes a specific language without user opt-in.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: This code sends a request to an external service at the configured gateway URL, but there is no confirmation prompt, user-facing disclosure, or warning that the skill will contact a remote server. For a code file, outbound network access that may transmit user-supplied inputs or system context should have some visible disclosure unless clearly communicated elsewhere in the skill.

Static analysis

No suspicious patterns detected.