Security audit
Security checks for vulnerabilities and agentic risk
This drink-ordering tool needs review because some outputs expose full gift-card numbers despite its promised privacy protections.
Prefer a version that fixes gift-card masking before using it through an agent. Keep order and error output out of shared chats or logs, protect your login token and capture files, and explicitly approve purchases and cancellations. The bundled shared signing key has unverified provenance.
tools/mxbc_key.mxbcApplication signing private key distributed in plaintext
Where the corresponding key remains accepted, recipients can forge the application-signature layer and build clients without this CLI's endpoint and confirmation restrictions. This does not itself bypass server-side account authentication or grant access to another user's account.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
_assert_target(url)
status = None
try:
with _OPENER.open(req, timeout=25) as r:
status = r.status
txt = r.read().decode('utf-8', 'replace')
except urllib.error.HTTPError as e:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# 复制成 .env 后填写，然后 chmod 600 .env
# 凭据全部来自你自己的抓包：mixuebingcheng-cli har 抓包.har
MIXUE_TOKEN=
MIXUE_OPENID=
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# 复制成 .env 后填写，然后 chmod 600 .env
# 凭据全部来自你自己的抓包：mixuebingcheng-cli har 抓包.har
MIXUE_TOKEN=
MIXUE_OPENID=
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
这时需要自己提供一份 RSA PEM 私钥：
mixuebingcheng-cli key --set /path/to/your_key.pem # 校验后写入 .env 的 MIXUE_KEY_PATH
# 或写进 .env：
MIXUE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
处置：新的 .gitignore 覆盖
.env / .env.*（保留 .env.example）
*.pem *.key *.p12 *.pfx
tools/ token.txt openid.txt customer_id.txt *.token
*.har *.har.gz *.chlsj *.saz
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
find . -name "*.pem" -o -name "*.key"
# 期望输出只有 ./tools/mxbc_key.pem
# 2. 有没有 .env
ls -a | grep -x ".env"
# 3. 有没有抓包原件
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_env():
"""按优先级读 .env：$MIXUE_ENV → $ROOT/.env → ~/.config/mixue/.env
已存在的真实环境变量优先（setdefault），所以 export 的值总能盖住文件。
"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_env():
"""按优先级读 .env：$MIXUE_ENV → $ROOT/.env → ~/.config/mixue/.env
已存在的真实环境变量优先（setdefault），所以 export 的值总能盖住文件。
"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def save_token(tok):
"""写 token：有 .env 就更新其中的 MIXUE_TOKEN 行，否则写 tools/token.txt。"""
if ENV_FILE and os.path.exists(ENV_FILE):
return _save_env_var('MIXUE_TOKEN', tok)
d = os.path.dirname(TOKEN_PATH)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def cmd_init(a):
"""首次配置：没有 .env 就按模板生成，并打印需要填的项。"""
target = ENV_FILE or os.path.join(ROOT, '.env')
created = False
if not os.path.exists(target):
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
return
tok = load_token()
if not tok:
die('未设置 token：`mixuebingcheng-cli token --stdin`（粘贴后 Ctrl-D）或写进 .env 的 MIXUE_TOKEN')
try:
payload = tok.split('.')[1]
payload += '=' * (-len(payload) % 4)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
s.add_argument('--shop', default=DEFAULT_SHOP, required=not DEFAULT_SHOP)
s.set_defaults(func=cmd_giftcards)
s = sub.add_parser('env', help='显示配置来源（.env / 环境变量 / 旧文件），不打印密钥明文')
s.set_defaults(func=cmd_env)
s = sub.add_parser('init', help='首次配置：生成 .env 模板并提示怎么获取凭据')
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
s = sub.add_parser('env', help='显示配置来源（.env / 环境变量 / 旧文件），不打印密钥明文')
s.set_defaults(func=cmd_env)
s = sub.add_parser('init', help='首次配置：生成 .env 模板并提示怎么获取凭据')
s.set_defaults(func=cmd_init)
s = sub.add_parser('har', help='从抓包 .har 自动提取 Access-Token / openId / customerId')
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# 期望输出只有 ./tools/mxbc_key.pem
# 2. 有没有 .env
ls -a | grep -x ".env"
# 3. 有没有抓包原件
find . -name "*.har"
The core ordering behavior matches the description, and the exposed non-gift-card payment commands terminate without invoking payment. However, cmd_sms and cmd_login add an authentication workflow that contradicts the stated requirement for a token captured from the user's own traffic. In particular, SMS delivery is an additional externally observable action. Other features such as HAR import, signing, configuration storage, and order monitoring support the declared purpose. Network requests are restricted to the Mixue API host; no unrelated credential destination is evident.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mixuebingcheng-cli needs # 采集要求
mixuebingcheng-cli init # 生成 .env 模板
mixuebingcheng-cli har 抓包.har # 导入 token / openId / customerId
mixuebingcheng-cli whoami # 验证登录态
mixuebingcheng-cli shops --lat <纬度> --lng <经度>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
已存在的真实环境变量优先（setdefault），所以 export 的值总能盖住文件。
"""
cands = [os.environ.get('MIXUE_ENV'), os.path.join(ROOT, '.env'),
os.path.expanduser('~/.config/mixue/.env')]
for path in cands:
if not path or not os.path.exists(path):
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
已存在的真实环境变量优先（setdefault），所以 export 的值总能盖住文件。
"""
cands = [os.environ.get('MIXUE_ENV'), os.path.join(ROOT, '.env'),
os.path.expanduser('~/.config/mixue/.env')]
for path in cands:
if not path or not os.path.exists(path):
continue
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def cmd_init(a):
"""首次配置：没有 .env 就按模板生成，并打印需要填的项。"""
target = ENV_FILE or os.path.join(ROOT, '.env')
created = False
if not os.path.exists(target):
with open(target, 'w', encoding='utf-8') as f:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
s.set_defaults(func=cmd_needs)
s = sub.add_parser('key', help='查看/设置签名私钥（状态与路径）')
s.add_argument('--set', default=None, help='指定 PEM 私钥文件路径并写入 .env')
s.set_defaults(func=cmd_key)
s = sub.add_parser('cancel', help='取消订单（需 --yes）')
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
return REDACT_EXACT[kl]
for suf, rule in REDACT_SUFFIX:
if kl.endswith(suf):
return rule
return None
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _save_env_var(key, value):
"""把 key=value 写进 .env（存在则替换该行，不存在则追加），0600。"""
target = ENV_FILE or os.path.join(ROOT, '.env')
lines, found = [], False
if os.path.exists(target):
with open(target, encoding='utf-8') as f:
Without declared permissions the skill's intent is opaque and cannot be validated.
The payment helper returns full card numbers as string elements under 'cards', and other order output uses similar arrays under 'giftcard'; neither key triggers the card-number redaction rules. Recursive processing of those strings masks only phone-number patterns or JWT-shaped values, so gift-card identifiers can reach agent transcripts and logs despite default redaction, although whether a card number alone enables spending is not established.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
d = os.path.dirname(TOKEN_PATH)
if d:
os.makedirs(d, exist_ok=True)
with open(TOKEN_PATH, 'w') as f:
f.write(tok)
os.chmod(TOKEN_PATH, 0o600)
os.environ['MIXUE_TOKEN'] = tok