Security audit

Meituan Api Fetcher

Security checks across malware telemetry and agentic risk

Overview

This is mostly a Meituan API documentation scraper, but it includes anti-bot bypass guidance and scripts whose advertised commands can unexpectedly perform scraping and file writes.

Review before installing. Use it only if you are authorized to access Meituan developer materials, avoid running the scraper against platform controls, expect the scripts to contact Meituan and rewrite local generated files, and treat the included API examples as sensitive integration material that may contain unsafe token-handling patterns.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (94)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill explicitly documents anti-bot/WAF bypass methods ('disable-blink-features', hiding webdriver, and using a real user agent). Even if presented as a technical characteristic, this materially helps evade a third-party platform's detection controls and can facilitate unauthorized scraping or access at scale.

Intent-Code Divergence

Medium

Confidence: 79% confidence
Finding: The endpoint is titled as an order-id based lookup, but the documented request only exposes a generic needLog flag and does not show required order ID filters. In a tool catalog, this mismatch can cause agents to invoke a broad order-listing API and retrieve excessive order, address, phone, and payment-log data beyond the intended target.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown includes anti-bot bypass techniques without any warning, legal boundary, or safety justification. That omission increases the likelihood that users will treat evasion of platform defenses as endorsed behavior, creating abuse and compliance risk.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The script writes scraped content into local workspace directories and a report file without any explicit user notice, confirmation, or dry-run mode. In an agent/skill context, unexpected filesystem modification can surprise users, overwrite prior outputs, and create persistence of external content in the local environment.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The script performs automated requests to an external website using Playwright, but there is no explicit disclosure to the user that network access and content retrieval will occur. In a skill setting, undisclosed outbound access can violate user expectations, trigger policy concerns, and retrieve untrusted remote content into the local workspace.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The sample code logs the local authToken directly with statements such as `System.out.println("use cache " + this.localServerAuthToken)` and `System.out.println("new localserver auth token is " + this.localServerAuthToken)`. Since this token is then used as the `appToken` header for privileged local POS operations, disclosure through logs can enable unauthorized use by anyone with log access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document describes broad access to merchant, order, and member/CRM data, including member assets, transaction histories, coupons, and order details, but provides no privacy, retention, minimization, or consent guidance. In a skill context, this omission increases the chance that an integrating agent or developer will over-collect or mishandle sensitive commercial and personal data under the assumption that authorization alone is sufficient.

Ssd 2

Medium

Confidence: 98% confidence
Finding: The '绕过方式' field goes beyond neutral description and provides operational guidance for evading anti-automation detection. This is dangerous because it lowers the barrier for misuse and normalizes stealth techniques against a live platform.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: "response_params": [], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"code\": 0,\n \"message\": \"example\",\n \"totalRecords\": 1,\n \"data\": [\n {\n \"operateType\": 1,\n \"operateName\": \"example\",\n \"poiId\": 1000,\n \"poiName\": \"example\",\n \"issuePoiId\": 1000,\n \"issuePoiName\": \"example\",\n \"memberId\": 1000,\n \"cardId\": 1000,\n \"cardNo\": \"example\",\n \"kindCode\": 1,\n \"cardStatus\": 1,\n \"gradeId\": 1000,\n \"gradeName\": \"example\",\n \"cardTypeId\": 1000,\n \"cardTypeName\": \"example\",\n \"payTypeName\": \"example\",\n \"orderId\": \"example\",\n \"orderNo\": \"example\",\n \"ctime\": 1646809611242,\n \"orderMoney\": 1000,\n \"receiveMoney\": 1000,\n \"operateMoney\": 1000,\n \"giftPointsNum\": 1000,\n \"usePointsNum\": 1000,\n \"pointsNum\": 1000,\n \"pointsActMoney\": 1000,\n \"mainOperateMoney\": 1000,\n \"giftOperateMoney\": 1000,\n \"mainBalance\": 1000,\n \"giftBalance\": {},\n \"deposit\": {},\n \"payType\": {},\n \"payMethodName\": {},\n \"payStatus\": {},\n \"cardState\": \"example\",\n \"payTypeList\": \"example\",\n \"billTime\": 1000,\n \"operatorId\": 1646809611242,\n \"operatorName\": \"系统\",\n \"commissionId\": 20020,\n \"commissionName\": \"服务员\",\n \"opSource\": 1,\n \"opSourceDesc\": \"POS端\",\n \"remark\": \"消费金额累计满95.0元\"\n }\n ],\n \"pageCursor\": {\n \"firstCursor\": [\n {\n \"name\": \"example\",\n \"value\": \"example\",\n \"sortOrder\": \"example\",\n \"fieldOrder\": 1\n }\n ],\n \"lastCursor\": [\n {\n \"name\" ...[truncated 25 chars]
Confidence: 88% confidence
Finding: rms/crm/api/v1/chain/cards/transactions/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/cloudmall/order/list", "request_params": [ { "name": "needLog",
Confidence: 90% confidence
Finding: rms/crm/api/v1/chain/cloudmall/order/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: "response_params": [], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"merchantOrderDetailListRtn\": {\n \"data\": [\n {\n \"orderId\": 1605843659872301088,\n \"orderNo\": \"12221605843638800117833\",\n \"cloudMallName\": \"在线商城\",\n \"summary\": {\n \"payAmount\": 2000,\n \"payPoint\": 1000\n },\n \"status\": 5,\n \"remark\": \"快点发货\",\n \"merchantRemark\": \"加急单\",\n \"userInfo\": {\n \"name\": \"张三\",\n \"mobile\": \"13213131313\",\n \"cardNo\": \"c0001\"\n },\n \"deliveryType\": 1,\n \"receiverInfo\": {\n \"name\": \"张三\",\n \"mobile\": \"13212121212\",\n \"address\": \"上海市长宁区XX路xx号\",\n \"expressCompany\": \"顺丰快递\",\n \"expressNO\": \"999887734534524\"\n },\n \"skuList\": [\n {\n \"spuId\": \"554674369\",\n \"spuName\": \"牛排\",\n \"skuId\": \"554674368\",\n \"skuName\": \"牛排\",\n \"skuPic\": \"http://p0.meituan.net/rmscashier/*******.jpg\",\n \"quantity\": 1,\n \"itemType\": 10,\n \"price\": 3000,\n \"point\": 1000,\n \"id\": 76725\n }\n ],\n \"payInfo\": {\n \"payAmount\": 2000,\n \"memberCardPayAmount\": 1200,\n \"memberCardPayPoint\": 1000,\n \"payPlatform\": 0\n },\n \"refundInfo\": {\n \"refundPoint\": 1000,\n \"refundBalance\": 1200,\n \"includeFee\": 0,\n \"refundAmount\": 2000\n },\n \"payTime\": 1671697942000,\n \"deliveryAmount\": 0,\n \"refundStatus\": 0,\n \"orderTime\": 1671697933000,\n \"log ...[truncated 25 chars]
Confidence: 90% confidence
Finding: rms/crm/api/v1/chain/cloudmall/order/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/cloudmall/order/page", "request_params": [ { "name": "cloudMallIds",
Confidence: 87% confidence
Finding: rms/crm/api/v1/chain/cloudmall/order/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: "response_params": [], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"data\": {\n \"orderList\": [\n {\n \"id\": 1605843659872301088,\n \"orderNo\": \"12221605843638800117833\",\n \"orderTime\": 1671697933000\n }\n ]\n }\n }\n}", "title": "总部分页查询积分商城订单-美团技术服务合作中心", "api_path": "/rms/crm/api/v1/chain/cloudmall/order/page", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-chain-cloudmall-order-page" }, {
Confidence: 87% confidence
Finding: rms/crm/api/v1/chain/cloudmall/order/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/coupon/detail/query", "request_params": [ { "name": "templateId",
Confidence: 86% confidence
Finding: rms/crm/api/v1/chain/coupon/detail/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: "response_params": [], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"dataList\": [\n {\n \"couponTemplateId\": 34465632,\n \"couponId\": 294277588,\n \"couponCode\": \"673313473016\",\n \"title\": \"代金券\",\n \"type\": 1,\n \"price\": 1000,\n \"sendTime\": 1641539108000,\n \"sentChannelName\": \"给会员发券\",\n \"sentChannel\": 12,\n \"memberName\": \"李李李\",\n \"telephone\": \"13200000009\",\n \"giftable\": 1,\n \"startTime\": 1641484800000,\n \"endTime\": 1641494800000,\n \"status\": 1,\n \"consumeDetail\": {\n \"orderId\": \"1479348464302170161\",\n \"orderAmount\": 18501,\n \"consumeTime\": 1641539129000,\n \"consumedValue\": 1000,\n \"consumePoiId\": 600285141,\n \"consumePoiName\": \"嘤嘤\",\n \"consumeOrgId\": 600285141\n },\n \"unionId\": \"example\"\n }\n ],\n \"paged\": {\n \"pageNo\": 1,\n \"pageSize\": 10,\n \"totalCount\": 11,\n \"totalPageCount\": 2\n },\n \"pageCursor\": {\n \"firstCursor\": [\n {\n \"name\": \"couponId\",\n \"value\": \"294277588\",\n \"sortOrder\": \"desc\",\n \"fieldOrder\": 2\n }\n ],\n \"lastCursor\": [\n {\n \"name\": \"couponId\",\n \"value\": \"294277579\",\n \"sortOrder\": \"desc\",\n \"fieldOrder\": 2\n }\n ]\n }\n }\n}", "title": "总部-根据券模版ID查询优惠券列表-美团技术服务合作中心", "api_path": "/rms/crm/api/v1/chain/coupon/detail/query", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-chain-coupon-detail-query" }, {
Confidence: 86% confidence
Finding: rms/crm/api/v1/chain/coupon/detail/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/coupon/transfer/detail/query", "request_params": [ { "name": "orgId",
Confidence: 84% confidence
Finding: rms/crm/api/v1/chain/coupon/transfer/detail/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"paged\": {\n \"pageNo\": 1,\n \"pageSize\": 20,\n \"totalCount\": 1,\n \"totalPageCount\": 1\n },\n \"dataList\": [\n {\n \"couponId\": 280773921,\n \"couponCode\": \"136724538961\",\n \"title\": \"满N件打折最低\",\n \"type\": 3,\n \"price\": 1000,\n \"transferTime\": \"2022-01-07 16:58:07\",\n \"transferStatus\": 2,\n \"sendTransferUser\": {\n \"id\": \"106712665\",\n \"type\": 4\n },\n \"receTransferUser\": {\n \"id\": \"104371170\",\n \"type\": 4\n },\n \"status\": 1\n }\n ]\n }\n}", "title": "总部-查询优惠券转赠列表-美团技术服务合作中心", "api_path": "/rms/crm/api/v1/chain/coupon/transfer/detail/query", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-chain-coupon-transfer-detail-query" }, {
Confidence: 84% confidence
Finding: rms/crm/api/v1/chain/coupon/transfer/detail/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/member/asset/query", "request_params": [ { "name": "orgId",
Confidence: 88% confidence
Finding: rms/crm/api/v1/chain/member/asset/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"memberId\": \"121313141\",\n \"cards\": [\n {\n \"cardId\": \"123113141\",\n \"cardNo\": \"1231\",\n \"cardName\": \"权益卡\",\n \"gradeName\": \"黄金\",\n \"balance\": 100,\n \"rechargeBalance\": 50,\n \"giftBalance\": 50,\n \"point\": 100,\n \"couponNum\": 1,\n \"status\": 4\n }\n ]\n }\n}", "title": "总部-查询会员资产列表-美团技术服务合作中心", "api_path": "/rms/crm/api/v1/chain/member/asset/query", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-chain-member-asset-query" }, {
Confidence: 88% confidence
Finding: rms/crm/api/v1/chain/member/asset/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/member/search", "request_params": [ { "name": "orgId",
Confidence: 83% confidence
Finding: rms/crm/api/v1/chain/member/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"data\": [\n {\n \"memberId\": \"121141231\",\n \"name\": \"test\",\n \"mobile\": \"152****5810\",\n \"sex\": 1,\n \"birthdayType\": 1,\n \"birthday\": 1595575131000,\n \"status\": 1,\n \"ctime\": 1695575131000,\n \"poiId\": 100156789,\n \"poiName\": \"测试门店\",\n \"source\": 1,\n \"nickName\": \"test\"\n }\n ]\n }\n}", "title": "总部-根据会员ID查询会员详情-美团技术服务合作中心", "api_path": "/rms/crm/api/v1/chain/member/search", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-chain-member-search" }, {
Confidence: 83% confidence
Finding: rms/crm/api/v1/chain/member/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/chain/page/query/members", "request_params": [ { "name": "orgId",
Confidence: 87% confidence
Finding: rms/crm/api/v1/chain/page/query/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: "response_params": [], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"code\": 1,\n \"message\": \"example\",\n \"totalRecords\": 1,\n \"data\": [\n {\n \"id\": 121141231,\n \"name\": \"test\",\n \"mobile\": \"example\",\n \"ctime\": 1695575131000,\n \"poiId\": 100156789,\n \"poiName\": \"测试门店\",\n \"source\": 1,\n \"agencyId\": 1000,\n \"orgId\": 1000,\n \"type\": 1,\n \"cardQuantity\": 1000,\n \"consumeCount\": 1000,\n \"consumeMoney\": 1000,\n \"balance\": 1000,\n \"points\": 1000,\n \"couponValidQuantity\": 1000,\n \"cardIds\": [\n 1000\n ]\n }\n ],\n \"pageCursor\": {\n \"firstCursor\": [\n {\n \"name\": \"example\",\n \"value\": \"example\",\n \"sortOrder\": \"example\",\n \"fieldOrder\": 1\n }\n ],\n \"lastCursor\": [\n {\n \"name\": \"example\",\n \"value\": \"example\",\n \"sortOrder\": \"example\",\n \"fieldOrder\": 1\n }\n ]\n }\n }\n}", "title": "总部-查询会员列表-美团技术服务合作中心", "api_path": "/rms/crm/api/v1/chain/page/query/members", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-chain-page-query-members" }, {
Confidence: 87% confidence
Finding: rms/crm/api/v1/chain/page/query/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: }, { "method": "POST", "path": "/rms/crm/api/v1/poi/cards/query", "request_params": [ { "name": "orgId",
Confidence: 86% confidence
Finding: rms/crm/api/v1/poi/cards/

Tool Parameter Abuse

High

Category: Tool Misuse
Content: "response_params": [], "response_example": "{\n \"code\": \"OP_SUCCESS\",\n \"msg\": \"成功\",\n \"traceId\": \"8531422235710213256\",\n \"data\": {\n \"code\": 0,\n \"message\": \"success\",\n \"totalRecords\": 10,\n \"data\": {\n \"id\": 100105346,\n \"memberId\": 100090108,\n \"cardNo\": \"10110\",\n \"cardTypeId\": 30048057,\n \"cardTypeName\": \"巴黎春天_门店_会员_01\",\n \"gradeId\": 872412,\n \"gradeName\": \"普通等级\",\n \"poiId\": 60000226,\n \"poiName\": \"巴黎春天咖啡show\",\n \"status\": 1,\n \"utime\": 1580978925577,\n \"deposit\": 100,\n \"totalBalance\": 200,\n \"mainBalance\": 100,\n \"giftBalance\": 100,\n \"limitDeposit\": 300,\n \"limitGrant\": 300,\n \"pointsNumLong\": 10,\n \"avaiableTime\": 1640758623478,\n \"gradeValidity\": 1640758623478,\n \"startDate\": 1640758623478,\n \"writeCardStatus\": 1,\n \"firstRechargeTime\": 1640758623478,\n \"ctime\": 1640758623478\n }\n }\n}", "title": "美团技术服务合作中心", "api_path": "/rms/crm/api/v1/poi/cards/query", "doc_url": "https://developer.meituan.com/docs/api/rms-crm-api-v1-poi-cards-query" }, {
Confidence: 86% confidence
Finding: rms/crm/api/v1/poi/cards/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.