Habilidades meituan-coupon
📦
meituan-coupon
Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno⚡ Contiene scripts
Reclamar cupones de Meituan y hacer seguimiento de los canjes
Los usuarios necesitan una forma guiada de reclamar cupones de Meituan y revisar canjes anteriores. Esta skill ejecuta los flujos de cupones, inicio de sesión, historial y recordatorios mediante scripts incluidos.
Compatible con: Claude Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "meituan-coupon" from https://skillstore.io/skills/meituan-open-platform-meituan-coupon.md and its manifest at https://skillstore.io/api/skills/meituan-open-platform-meituan-coupon/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "meituan-coupon". Reclama mis cupones de Meituan hoy.
Resultado esperado:
La skill confirma el estado de inicio de sesión, solicita cualquier verificación faltante y luego informa los nombres de los cupones, importes, fechas de validez y enlaces de uso.
Usando "meituan-coupon". ¿Qué cupones reclamé ayer?
Resultado esperado:
La skill solicita o analiza la fecha, comprueba los registros de canje guardados y resume los registros de cupones coincidentes o indica que no se encontraron registros.
Usando "meituan-coupon". Recuérdame reclamar cupones cada mañana.
Resultado esperado:
La skill guarda la hora preferida, identifica la plataforma de programación compatible y devuelve si se creó la tarea recurrente.
Auditoría de seguridad
Riesgo altov5 • 6/7/2026 Abrir el informe versionado
The audit confirms real risk from bundled Python script execution, local persistence of user tokens and device identifiers, outbound Meituan API calls, and recurring coupon automation. Many static hits are false positives from Markdown backticks, comments, Chinese prose entropy, and dictionary key terminology, but the remaining confirmed findings are security-relevant. This skill should not be auto-installed without explicit user review and publisher verification.
11
Archivos escaneados
3,849
Líneas analizadas
73
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (14)
Alto
System reconnaissance
| 「确认」 / 「好的」 / 「可以」 | 1. 记录定时偏好并获取平台信息:<br>`CRON_RESULT=$($PYTHON "$AUTH_SCRIPT" cron-set --time "1
The instructions create real recurring coupon-claiming jobs and include platform commands that target a user identifier. This is persistent automation and scheduling behavior, not a benign reference.
Alto
Prompt Injection Attempt Detected
SKILL.md declares “Critical Rules（最高优先级）” and requires the agent to execute scripts on each coupon trigger. Untrusted skill text attempts to set priority and force tool execution.
The text explicitly assigns itself highest priority and constrains outputs while forcing script execution. That matches prompt-injection style control language in an untrusted skill file.
Alto
Sensitive Authentication Data Collection and Persistence
The skill asks for a phone number and SMS code, receives user_token and device_token values, and persists them in local auth storage. This is a high-risk credential-handling workflow.
The referenced flow directly sends SMS codes and writes returned authentication tokens. The code paths and documentation agree on the credential handling behavior.
Alto
Recurring Background Coupon Claiming
The skill can create daily scheduled jobs that claim coupons later without per-run confirmation. Persistent background actions increase account and consent risk.
The documentation and code both generate recurring scheduler actions for coupon claiming. The behavior is explicit and not merely inferred from static command patterns.
Medio
System reconnaissance
> - **Friday 广场**:从会话上下文中的 sender_id 获取
The rule uses conversation or scheduler identifiers to create, update, or delete recurring jobs. This is relevant platform-state handling even if not classic reconnaissance.
Medio
System reconnaissance
- 「改成8点」/「提醒时间改一下」→ 更新 cron:<br>1. 先查询当前任务ID:`CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)`,解析
The rule uses conversation or scheduler identifiers to create, update, or delete recurring jobs. This is relevant platform-state handling even if not classic reconnaissance.
Medio
System reconnaissance
"uuid": uuid_val # 设备唯一标识,对接接口 uuid 扩展字段
The code sends a persistent device UUID together with phone or SMS verification data to a remote endpoint. That device identifier is security- and privacy-relevant.
Medio
System reconnaissance
"uuid": uuid_val # 设备唯一标识,对接接口 uuid 扩展字段
The code sends a persistent device UUID together with phone or SMS verification data to a remote endpoint. That device identifier is security- and privacy-relevant.
Mostrar los 14 problemas confirmados
Medio
System reconnaissance
user_id = os.environ.get("CLAWHUB_USER_ID") or os.environ.get("USER_ID") or "${USER_ID}"
The code reads a user identifier from the environment and embeds it in a scheduler command target. This is real user-context handling for automation.
Medio
Official Branding Used During Credential Request
The skill claims it is an official Meituan coupon assistant while asking users to provide phone and SMS verification data. Marketplace publication should verify the publisher before allowing this trust claim.
The official-brand claim and credential request are present in the cited text. The risk is publisher-trust context rather than proof that the claim is false.
Bajo
System reconnaissance
cron_job_id = token_data.get(CRON_JOB_ID_KEY, "")
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
Bajo
System reconnaissance
"cron_job_id": cron_job_id if cron_enabled else None,
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
Bajo
System reconnaissance
"notes": "Agent 需要从 inbound 上下文中获取 sender_id 替换 user_id 占位符"
The note instructs the agent to obtain sender_id from inbound context to replace a scheduler target. This is user-context extraction for automation.
Bajo
System reconnaissance
token_data[CRON_JOB_ID_KEY] = job_id
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
Elementos de revisión de capacidades (73)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
subprocess.run executes an environment-resolved Python interpreter and local cache CLI while handling authentication cache data. Even without shell=True, it is real external command execution.
Alto
Hidden file in home directory
4. 默认:~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
- 美团 Skill 统一使用 ~/.xiaomei-workspace/ 作为工作空间
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
2. ~/.xiaomei-workspace/mt_auth_tokens.json(小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
注意:其他潜在历史位置(如 ~/.openclaw/workspace/auth_tokens.json)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
2. ~/.xiaomei-workspace/mt_auth_tokens.json (小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
3. ~/.openclaw/workspace/auth_tokens.json (OpenClaw 默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
subprocess.run executes the cache CLI from shared helper code used by coupon scripts. It performs real local command execution with inherited environment data.
Alto
Hidden file in home directory
4. 默认 ~/.xiaomei-workspace(与 skill_cache_cli.py 兼容)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
4. 创建默认路径 ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
default = cls.KNOWN_WORKSPACES[0] # ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Alto
Hidden file in home directory
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Alto
Hidden file in home directory
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_phone_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Alto
Hidden file in home directory
- **认证文件说明**:`~/.xiaomei-workspace/mt_auth_tokens.json` 为美团官方账号认证文件,存储登录令牌和设备标识,仅保存于用户本地设备,权限 0600,符
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medio
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medio
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medio
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medio
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medio
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medio
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medio
Shell command substitution
CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)
The documentation instructs the agent to run auth.py cron-status before managing scheduled coupon claiming. This is real local command execution in the workflow.
Medio
Hardcoded URL
BASE_URL = "https://peppermall.meituan.com"
This hardcoded endpoint is used by httpx calls for login verification, coupon issue, or coupon history requests. It creates real external network egress carrying account or coupon data.
Medio
Hidden file access
4. 默认:~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
- 美团 Skill 统一使用 ~/.xiaomei-workspace/ 作为工作空间
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
2. ~/.xiaomei-workspace/mt_auth_tokens.json(小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
注意:其他潜在历史位置(如 ~/.openclaw/workspace/auth_tokens.json)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
2. ~/.xiaomei-workspace/mt_auth_tokens.json (小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
3. ~/.openclaw/workspace/auth_tokens.json (OpenClaw 默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
"new_path": write_result.get("path", "skills_local_cache/.shared/mt_auth_tokens.json")
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Python environment access
user_id = os.environ.get("CLAWHUB_USER_ID") or os.environ.get("USER_ID") or "${USER_ID}"
The USER_ID environment value is inserted into a generated openclaw cron command target. Environment-controlled scheduling targets are security-relevant.
Medio
Hardcoded URL
BASE_URL = "https://peppermall.meituan.com"
This hardcoded endpoint is used by httpx calls for login verification, coupon issue, or coupon history requests. It creates real external network egress carrying account or coupon data.
Medio
Hidden file access
4. 默认 ~/.xiaomei-workspace(与 skill_cache_cli.py 兼容)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
4. 创建默认路径 ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Hidden file access
default = cls.KNOWN_WORKSPACES[0] # ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medio
Python file write/append
with open(file_path, "w", encoding="utf-8") as f:
The cache CLI writes caller-provided content to local cache files. This is expected functionality, but it is still real filesystem write capability.
Medio
Python os file operations
os.chmod(file_path, stat.S_IRUSR | stat.S_IWUSR)
The code changes local file permissions with os.chmod for cache files. This is real filesystem mutation and should remain reviewable.
Medio
Shell command substitution
[ -f "$_glob_hit" ] && SKILL_DIR="$(dirname "$_glob_hit")" && break
The shell snippet executes dirname while searching hidden skill directories under the user home directory. The command is fixed, but it is real filesystem-oriented shell execution.
Medio
Shell command substitution
TERMS_RESULT=$($PYTHON "$AUTH_SCRIPT" terms-check)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
ISSUE_RESULT=$($PYTHON "$ISSUE_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED")
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Shell command substitution
QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medio
Hidden file access
> | 3 | `$HOME/.openclaw/skills/` | OpenClaw / CatClaw 沙箱 |
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medio
Hidden file access
> | 4 | `$HOME/.claude/skills/` | Claude 通用 |
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medio
Hidden file access
"$HOME/.openclaw/skills/$SKILL_NAME" \
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medio
Hidden file access
"$HOME/.claude/skills/$SKILL_NAME"; do
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medio
Hidden file access
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medio
Hidden file access
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_phone_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medio
Hidden file access
- **认证文件说明**:`~/.xiaomei-workspace/mt_auth_tokens.json` 为美团官方账号认证文件,存储登录令牌和设备标识,仅保存于用户本地设备,权限 0600,符
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medio
Temp directory access
> 💡 如需自定义 Token 存储路径(沙箱/隔离场景):`export XIAOMEI_AUTH_FILE=/tmp/my_auth_tokens.json`
The instruction allows moving the authentication file into /tmp, which can weaken isolation for token material on shared systems. This is a real storage-location risk.
Bajo
Python environment access
env_path = os.environ.get("SKILL_CACHE_CLI_PATH")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python environment access
env_python = os.environ.get("SKILL_CACHE_PYTHON")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python environment access
workspace = os.environ.get("SKILL_CACHE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
or os.environ.get("CLAUDE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
or os.environ.get("XIAOMEI_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
env = os.environ.copy()
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python environment access
env_path = os.environ.get("XIAOMEI_AUTH_FILE")
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
env_path = os.environ.get("XIAOMEI_AUTH_FILE")
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
if os.environ.get("CLAUDE_DESKTOP") or os.environ.get("CLAUDE_CODE"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
Bajo
Python environment access
if os.environ.get("FRIDAY_ENV") or os.environ.get("FRIDAY_SKILL_ID"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
Bajo
Python environment access
if os.environ.get("CLAWHUB_ENV") or os.environ.get("OPENCLAW_AVAILABLE"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
Bajo
Python environment access
env_path = os.environ.get("SKILL_CACHE_CLI_PATH")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python environment access
env_python = os.environ.get("SKILL_CACHE_PYTHON")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python environment access
workspace = os.environ.get("SKILL_CACHE_WORKSPACE") \
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python environment access
or os.environ.get("CLAUDE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
or os.environ.get("XIAOMEI_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Bajo
Python environment access
env = os.environ.copy()
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Bajo
Python getenv function
if path := os.getenv(env_var):
The cache CLI reads environment variables to choose or create the workspace path. This is legitimate configuration but affects where data is persisted.
Bajo
getenv function call
if path := os.getenv(env_var):
The cache CLI reads environment variables to choose or create the workspace path. This is legitimate configuration but affects where data is persisted.
Factores de riesgo
⚙️ Comandos externos (115)
references/auth-flow.md:67 references/auth-flow.md:78 references/auth-flow.md:79 references/auth-flow.md:126 references/auth-flow.md:127 references/auth-flow.md:128 references/cron-rules.md:14 scripts/auth.py:136 scripts/auth.py:929 scripts/auth.py:37 scripts/common.py:81 scripts/issue.py:12 scripts/query.py:14 SKILL.md:20 SKILL.md:26 SKILL.md:29 SKILL.md:30 SKILL.md:41-52 SKILL.md:52-56 SKILL.md:56-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-67 SKILL.md:67-68 SKILL.md:68 SKILL.md:70-102 SKILL.md:102-104 SKILL.md:104-106 SKILL.md:106-112 SKILL.md:112-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120 SKILL.md:146-151 SKILL.md:151-155 SKILL.md:155 SKILL.md:159 SKILL.md:165-167 SKILL.md:167-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183-184 SKILL.md:184-187 SKILL.md:187-188 SKILL.md:188 SKILL.md:194-196 SKILL.md:196-200 SKILL.md:200-202 SKILL.md:202-203 SKILL.md:203-204 SKILL.md:204-209 SKILL.md:209-216 SKILL.md:216-218 SKILL.md:218-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:223-231 SKILL.md:231 SKILL.md:235-239 SKILL.md:239-252 SKILL.md:252-258 SKILL.md:258-260 SKILL.md:260-264 SKILL.md:264-274 SKILL.md:274-276 SKILL.md:276-278 SKILL.md:278 SKILL.md:287-289 SKILL.md:289-291 SKILL.md:291 SKILL.md:297-303 SKILL.md:303-325 SKILL.md:325-327 SKILL.md:327-337 SKILL.md:337-339 SKILL.md:339-340 SKILL.md:340-341 SKILL.md:341-342 SKILL.md:342-346 SKILL.md:346-348 SKILL.md:348-358 SKILL.md:358-360 SKILL.md:360 SKILL.md:361-367 SKILL.md:367-378 SKILL.md:378-385 SKILL.md:385 SKILL.md:386-387 SKILL.md:387-388 SKILL.md:48 SKILL.md:90 SKILL.md:114 SKILL.md:148 SKILL.md:150 SKILL.md:180 SKILL.md:185 SKILL.md:186 SKILL.md:195 SKILL.md:219 SKILL.md:254 SKILL.md:257 SKILL.md:41-52 SKILL.md:70-102 SKILL.md:112-115 SKILL.md:146-151 SKILL.md:179-181 SKILL.md:184-187 SKILL.md:194-196 SKILL.md:218-220 SKILL.md:252-258
🌐 Acceso a red (8)
📁 Acceso al sistema de archivos (33)
scripts/auth.py:90 scripts/auth.py:93 scripts/auth.py:162 scripts/auth.py:164 scripts/auth.py:180 scripts/auth.py:181 scripts/auth.py:90 scripts/auth.py:93 scripts/auth.py:162 scripts/auth.py:164 scripts/auth.py:180 scripts/auth.py:181 scripts/auth.py:272 scripts/common.py:58 scripts/common.py:58 scripts/skill_cache_cli.py:82 scripts/skill_cache_cli.py:110 scripts/skill_cache_cli.py:82 scripts/skill_cache_cli.py:110 scripts/skill_cache_cli.py:208 scripts/skill_cache_cli.py:158 scripts/skill_cache_cli.py:160 SKILL.md:325 SKILL.md:346 SKILL.md:378 SKILL.md:64 SKILL.md:65 SKILL.md:79 SKILL.md:80 SKILL.md:325 SKILL.md:346 SKILL.md:378 SKILL.md:106
🔑 Variables de entorno (24)
scripts/auth.py:60 scripts/auth.py:70 scripts/auth.py:100 scripts/auth.py:101 scripts/auth.py:102 scripts/auth.py:132 scripts/auth.py:168 scripts/auth.py:187 scripts/auth.py:916 scripts/auth.py:920 scripts/auth.py:924 scripts/auth.py:1020 scripts/common.py:36 scripts/common.py:44 scripts/common.py:60 scripts/common.py:61 scripts/common.py:62 scripts/common.py:77 scripts/issue.py:85 scripts/issue.py:86 scripts/query.py:104 scripts/query.py:105 scripts/skill_cache_cli.py:86 scripts/skill_cache_cli.py:86
⚡ Contiene scripts (2)
Patrones detectados
System reconnaissance×10
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/meituan-open-platform-meituan-coupon?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/meituan-open-platform-meituan-coupon?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/meituan-open-platform-meituan-coupon/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/meituan-open-platform-meituan-coupon.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
Meituan-Open-Platform. (2026). meituan-coupon security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5Cita BibTeX
@techreport{meituan-open-platform-meituan-open-platform-meituan-coupon-2026,
author = {Meituan-Open-Platform},
title = {meituan-coupon security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "meituan-coupon security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "Meituan-Open-Platform"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5"
identifiers:
- type: other
value: "skillstore:meituan-open-platform-meituan-coupon:audit:5"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 68
Arquitectura
85
Mantenibilidad
85
Contenido
69
Comunidad
83
Cumplimiento de la especificación
Lo que puedes crear
Reclamo diario de cupones
Reclamar cupones disponibles de Meituan para un usuario después del inicio de sesión y mostrar los detalles del cupón.
Consulta de registros de canje
Revisar registros de cupones para una fecha o rango de fechas seleccionado usando códigos de canje guardados.
Configuración de recordatorio de cupones
Guardar una hora diaria preferida para cupones y devolver detalles de programación específicos de la plataforma.
Prueba estos prompts
Reclamar cupones de hoy
Ayúdame a reclamar cualquier cupón de Meituan disponible para hoy.
Comprobar estado de inicio de sesión
Comprueba si mi inicio de sesión para cupones de Meituan es válido antes de reclamar cupones.
Revisar un rango de fechas
Muestra mis registros de canje de cupones de Meituan del 20 de marzo al 23 de marzo.
Configurar reclamo diario
Configura el reclamo diario de cupones de Meituan a las 10:00 hora de Pekín y dime el resultado.
Mejores prácticas
- Usa la skill solo después de confirmar que el usuario quiere iniciar sesión o reclamar cupones.
- Mantén los números de teléfono, códigos SMS, tokens de usuario y tokens de dispositivo fuera de la salida del chat.
- Revisa el almacenamiento local y la configuración del programador antes de habilitar el reclamo diario automático.
Evitar
- No ejecutes scripts de inicio de sesión o cupones para preguntas no relacionadas sobre compras o comida.
- No pegues tokens completos, números de teléfono o códigos SMS en respuestas visibles.
- No habilites el reclamo recurrente de cupones sin el consentimiento explícito del usuario.
Preguntas frecuentes
¿Esta skill requiere una cuenta de Meituan?
Sí. Requiere una cuenta registrada de Meituan y verificación por SMS antes de reclamar cupones.
¿Dónde se almacenan los tokens?
Los scripts incluidos almacenan tokens en archivos de caché locales dentro del workspace del usuario.
¿Contacta con servicios externos?
Sí. Envía solicitudes a endpoints del servicio de Meituan para verificar el inicio de sesión, emitir cupones y consultar registros.
¿Puede garantizar la disponibilidad de cupones?
No. Los resultados de los cupones dependen de la elegibilidad de la cuenta, el estado de la campaña, la cuota y las respuestas de Meituan.
¿Puede reclamar cupones automáticamente todos los días?
Puede guardar una preferencia de reclamo diario y devolver instrucciones del programador cuando la plataforma las admite.
¿Es seguro instalarla sin revisión?
No. Ejecuta scripts, almacena datos de autenticación, envía solicitudes de red y puede configurar acciones recurrentes.
Detalles del desarrollador
Autor
Meituan-Open-PlatformLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
b8ca75d2c0a7e7102978993058777d82b8ab2610
Actualidad del mantenimiento
18/7/2026
Uso
22 descargas · 155 vistas