Security checks across malware telemetry and agentic risk
This skill is a disclosed Meituan phone-automation tool, but it exposes broad unauthenticated Android control and sensitive screen/address access beyond a tightly scoped food-ordering workflow.
Review this carefully before installing. Only use it on a trusted machine and Android device, supervise every run, avoid exposing the HTTP server to any network, and disable USB debugging or stop the service afterward. Consider removing Frida/frida-tools, pinning dependencies, binding the server to localhost with authentication, and requiring explicit confirmation before screen reading, address access, dialog approval, cart changes, or checkout navigation.
def _get_focus() -> str:
"""返回当前前台 Activity 的 focus 字符串"""
try:
return subprocess.check_output(
"adb shell dumpsys window | grep mCurrentFocus | tail -1",
shell=True, text=True, stderr=subprocess.DEVNULL
)frida>=16.0.0 frida-tools>=12.0.0 typer[all]>=0.9.0 rich>=13.0.0
frida>=16.0.0 frida-tools>=12.0.0 typer[all]>=0.9.0 rich>=13.0.0 mcp[cli]>=1.0.0
frida>=16.0.0 frida-tools>=12.0.0 typer[all]>=0.9.0 rich>=13.0.0 mcp[cli]>=1.0.0 pydantic>=2.0.0
typer[all]>=0.9.0 rich>=13.0.0 mcp[cli]>=1.0.0 pydantic>=2.0.0
65/65 vendors flagged this skill as clean.