Skills meituan-coupon
📦
meituan-coupon
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts
Claim Meituan Coupons and Track Redemptions
Users need a guided way to claim Meituan coupons and review past redemptions. This skill runs the coupon, login, history, and reminder flows through bundled scripts.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "meituan-coupon" from https://skillstore.io/skills/meituan-open-platform-meituan-coupon.md and its manifest at https://skillstore.io/api/skills/meituan-open-platform-meituan-coupon/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "meituan-coupon". Claim my Meituan coupons today.
Expected outcome:
The skill confirms login status, requests any missing verification, then reports the coupon names, amounts, validity dates, and use links.
Using "meituan-coupon". What coupons did I claim yesterday?
Expected outcome:
The skill asks for or parses the date, checks saved redemption records, and summarizes matching coupon records or says no records were found.
Using "meituan-coupon". Remind me to claim coupons every morning.
Expected outcome:
The skill saves the preferred time, identifies the supported scheduling platform, and returns whether the recurring task was created.
Security Audit
High Riskv5 • 7/6/2026 Open versioned report
The audit confirms real risk from bundled Python script execution, local persistence of user tokens and device identifiers, outbound Meituan API calls, and recurring coupon automation. Many static hits are false positives from Markdown backticks, comments, Chinese prose entropy, and dictionary key terminology, but the remaining confirmed findings are security-relevant. This skill should not be auto-installed without explicit user review and publisher verification.
11
Files scanned
3,849
Lines analyzed
73
Review items
0
False positives ignored
Confirmed security concerns (14)
High
System reconnaissance
| 「确认」 / 「好的」 / 「可以」 | 1. 记录定时偏好并获取平台信息:<br>`CRON_RESULT=$($PYTHON "$AUTH_SCRIPT" cron-set --time "1
The instructions create real recurring coupon-claiming jobs and include platform commands that target a user identifier. This is persistent automation and scheduling behavior, not a benign reference.
High
Prompt Injection Attempt Detected
SKILL.md declares “Critical Rules（最高优先级）” and requires the agent to execute scripts on each coupon trigger. Untrusted skill text attempts to set priority and force tool execution.
The text explicitly assigns itself highest priority and constrains outputs while forcing script execution. That matches prompt-injection style control language in an untrusted skill file.
High
Sensitive Authentication Data Collection and Persistence
The skill asks for a phone number and SMS code, receives user_token and device_token values, and persists them in local auth storage. This is a high-risk credential-handling workflow.
The referenced flow directly sends SMS codes and writes returned authentication tokens. The code paths and documentation agree on the credential handling behavior.
High
Recurring Background Coupon Claiming
The skill can create daily scheduled jobs that claim coupons later without per-run confirmation. Persistent background actions increase account and consent risk.
The documentation and code both generate recurring scheduler actions for coupon claiming. The behavior is explicit and not merely inferred from static command patterns.
Medium
System reconnaissance
> - **Friday 广场**:从会话上下文中的 sender_id 获取
The rule uses conversation or scheduler identifiers to create, update, or delete recurring jobs. This is relevant platform-state handling even if not classic reconnaissance.
Medium
System reconnaissance
- 「改成8点」/「提醒时间改一下」→ 更新 cron:<br>1. 先查询当前任务ID:`CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)`,解析
The rule uses conversation or scheduler identifiers to create, update, or delete recurring jobs. This is relevant platform-state handling even if not classic reconnaissance.
Medium
System reconnaissance
"uuid": uuid_val # 设备唯一标识,对接接口 uuid 扩展字段
The code sends a persistent device UUID together with phone or SMS verification data to a remote endpoint. That device identifier is security- and privacy-relevant.
Medium
System reconnaissance
"uuid": uuid_val # 设备唯一标识,对接接口 uuid 扩展字段
The code sends a persistent device UUID together with phone or SMS verification data to a remote endpoint. That device identifier is security- and privacy-relevant.
Show all 14 confirmed findings
Medium
System reconnaissance
user_id = os.environ.get("CLAWHUB_USER_ID") or os.environ.get("USER_ID") or "${USER_ID}"
The code reads a user identifier from the environment and embeds it in a scheduler command target. This is real user-context handling for automation.
Medium
Official Branding Used During Credential Request
The skill claims it is an official Meituan coupon assistant while asking users to provide phone and SMS verification data. Marketplace publication should verify the publisher before allowing this trust claim.
The official-brand claim and credential request are present in the cited text. The risk is publisher-trust context rather than proof that the claim is false.
Low
System reconnaissance
cron_job_id = token_data.get(CRON_JOB_ID_KEY, "")
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
Low
System reconnaissance
"cron_job_id": cron_job_id if cron_enabled else None,
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
Low
System reconnaissance
"notes": "Agent 需要从 inbound 上下文中获取 sender_id 替换 user_id 占位符"
The note instructs the agent to obtain sender_id from inbound context to replace a scheduler target. This is user-context extraction for automation.
Low
System reconnaissance
token_data[CRON_JOB_ID_KEY] = job_id
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
Capability review items (73)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
subprocess.run executes an environment-resolved Python interpreter and local cache CLI while handling authentication cache data. Even without shell=True, it is real external command execution.
High
Hidden file in home directory
4. 默认:~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
- 美团 Skill 统一使用 ~/.xiaomei-workspace/ 作为工作空间
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
2. ~/.xiaomei-workspace/mt_auth_tokens.json(小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
注意:其他潜在历史位置(如 ~/.openclaw/workspace/auth_tokens.json)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
2. ~/.xiaomei-workspace/mt_auth_tokens.json (小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
3. ~/.openclaw/workspace/auth_tokens.json (OpenClaw 默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
subprocess.run executes the cache CLI from shared helper code used by coupon scripts. It performs real local command execution with inherited environment data.
High
Hidden file in home directory
4. 默认 ~/.xiaomei-workspace(与 skill_cache_cli.py 兼容)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
4. 创建默认路径 ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
default = cls.KNOWN_WORKSPACES[0] # ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
High
Hidden file in home directory
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
High
Hidden file in home directory
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_phone_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
High
Hidden file in home directory
- **认证文件说明**:`~/.xiaomei-workspace/mt_auth_tokens.json` 为美团官方账号认证文件,存储登录令牌和设备标识,仅保存于用户本地设备,权限 0600,符
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medium
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medium
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medium
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medium
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medium
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medium
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
Medium
Shell command substitution
CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)
The documentation instructs the agent to run auth.py cron-status before managing scheduled coupon claiming. This is real local command execution in the workflow.
Medium
Hardcoded URL
BASE_URL = "https://peppermall.meituan.com"
This hardcoded endpoint is used by httpx calls for login verification, coupon issue, or coupon history requests. It creates real external network egress carrying account or coupon data.
Medium
Hidden file access
4. 默认:~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
- 美团 Skill 统一使用 ~/.xiaomei-workspace/ 作为工作空间
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
2. ~/.xiaomei-workspace/mt_auth_tokens.json(小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
注意:其他潜在历史位置(如 ~/.openclaw/workspace/auth_tokens.json)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
2. ~/.xiaomei-workspace/mt_auth_tokens.json (小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
3. ~/.openclaw/workspace/auth_tokens.json (OpenClaw 默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
"new_path": write_result.get("path", "skills_local_cache/.shared/mt_auth_tokens.json")
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Python environment access
user_id = os.environ.get("CLAWHUB_USER_ID") or os.environ.get("USER_ID") or "${USER_ID}"
The USER_ID environment value is inserted into a generated openclaw cron command target. Environment-controlled scheduling targets are security-relevant.
Medium
Hardcoded URL
BASE_URL = "https://peppermall.meituan.com"
This hardcoded endpoint is used by httpx calls for login verification, coupon issue, or coupon history requests. It creates real external network egress carrying account or coupon data.
Medium
Hidden file access
4. 默认 ~/.xiaomei-workspace(与 skill_cache_cli.py 兼容)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
4. 创建默认路径 ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Hidden file access
default = cls.KNOWN_WORKSPACES[0] # ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
Medium
Python file write/append
with open(file_path, "w", encoding="utf-8") as f:
The cache CLI writes caller-provided content to local cache files. This is expected functionality, but it is still real filesystem write capability.
Medium
Python os file operations
os.chmod(file_path, stat.S_IRUSR | stat.S_IWUSR)
The code changes local file permissions with os.chmod for cache files. This is real filesystem mutation and should remain reviewable.
Medium
Shell command substitution
[ -f "$_glob_hit" ] && SKILL_DIR="$(dirname "$_glob_hit")" && break
The shell snippet executes dirname while searching hidden skill directories under the user home directory. The command is fixed, but it is real filesystem-oriented shell execution.
Medium
Shell command substitution
TERMS_RESULT=$($PYTHON "$AUTH_SCRIPT" terms-check)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
ISSUE_RESULT=$($PYTHON "$ISSUE_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED")
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Shell command substitution
QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
Medium
Hidden file access
> | 3 | `$HOME/.openclaw/skills/` | OpenClaw / CatClaw 沙箱 |
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medium
Hidden file access
> | 4 | `$HOME/.claude/skills/` | Claude 通用 |
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medium
Hidden file access
"$HOME/.openclaw/skills/$SKILL_NAME" \
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medium
Hidden file access
"$HOME/.claude/skills/$SKILL_NAME"; do
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
Medium
Hidden file access
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medium
Hidden file access
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_phone_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medium
Hidden file access
- **认证文件说明**:`~/.xiaomei-workspace/mt_auth_tokens.json` 为美团官方账号认证文件,存储登录令牌和设备标识,仅保存于用户本地设备,权限 0600,符
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
Medium
Temp directory access
> 💡 如需自定义 Token 存储路径(沙箱/隔离场景):`export XIAOMEI_AUTH_FILE=/tmp/my_auth_tokens.json`
The instruction allows moving the authentication file into /tmp, which can weaken isolation for token material on shared systems. This is a real storage-location risk.
Low
Python environment access
env_path = os.environ.get("SKILL_CACHE_CLI_PATH")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python environment access
env_python = os.environ.get("SKILL_CACHE_PYTHON")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python environment access
workspace = os.environ.get("SKILL_CACHE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
or os.environ.get("CLAUDE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
or os.environ.get("XIAOMEI_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
env = os.environ.copy()
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python environment access
env_path = os.environ.get("XIAOMEI_AUTH_FILE")
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
env_path = os.environ.get("XIAOMEI_AUTH_FILE")
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
if os.environ.get("CLAUDE_DESKTOP") or os.environ.get("CLAUDE_CODE"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
Low
Python environment access
if os.environ.get("FRIDAY_ENV") or os.environ.get("FRIDAY_SKILL_ID"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
Low
Python environment access
if os.environ.get("CLAWHUB_ENV") or os.environ.get("OPENCLAW_AVAILABLE"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
Low
Python environment access
env_path = os.environ.get("SKILL_CACHE_CLI_PATH")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python environment access
env_python = os.environ.get("SKILL_CACHE_PYTHON")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python environment access
workspace = os.environ.get("SKILL_CACHE_WORKSPACE") \
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python environment access
or os.environ.get("CLAUDE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
or os.environ.get("XIAOMEI_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
Low
Python environment access
env = os.environ.copy()
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
Low
Python getenv function
if path := os.getenv(env_var):
The cache CLI reads environment variables to choose or create the workspace path. This is legitimate configuration but affects where data is persisted.
Low
getenv function call
if path := os.getenv(env_var):
The cache CLI reads environment variables to choose or create the workspace path. This is legitimate configuration but affects where data is persisted.
Risk Factors
⚙️ External commands (115)
references/auth-flow.md:67 references/auth-flow.md:78 references/auth-flow.md:79 references/auth-flow.md:126 references/auth-flow.md:127 references/auth-flow.md:128 references/cron-rules.md:14 scripts/auth.py:136 scripts/auth.py:929 scripts/auth.py:37 scripts/common.py:81 scripts/issue.py:12 scripts/query.py:14 SKILL.md:20 SKILL.md:26 SKILL.md:29 SKILL.md:30 SKILL.md:41-52 SKILL.md:52-56 SKILL.md:56-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-67 SKILL.md:67-68 SKILL.md:68 SKILL.md:70-102 SKILL.md:102-104 SKILL.md:104-106 SKILL.md:106-112 SKILL.md:112-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120 SKILL.md:146-151 SKILL.md:151-155 SKILL.md:155 SKILL.md:159 SKILL.md:165-167 SKILL.md:167-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183-184 SKILL.md:184-187 SKILL.md:187-188 SKILL.md:188 SKILL.md:194-196 SKILL.md:196-200 SKILL.md:200-202 SKILL.md:202-203 SKILL.md:203-204 SKILL.md:204-209 SKILL.md:209-216 SKILL.md:216-218 SKILL.md:218-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:223-231 SKILL.md:231 SKILL.md:235-239 SKILL.md:239-252 SKILL.md:252-258 SKILL.md:258-260 SKILL.md:260-264 SKILL.md:264-274 SKILL.md:274-276 SKILL.md:276-278 SKILL.md:278 SKILL.md:287-289 SKILL.md:289-291 SKILL.md:291 SKILL.md:297-303 SKILL.md:303-325 SKILL.md:325-327 SKILL.md:327-337 SKILL.md:337-339 SKILL.md:339-340 SKILL.md:340-341 SKILL.md:341-342 SKILL.md:342-346 SKILL.md:346-348 SKILL.md:348-358 SKILL.md:358-360 SKILL.md:360 SKILL.md:361-367 SKILL.md:367-378 SKILL.md:378-385 SKILL.md:385 SKILL.md:386-387 SKILL.md:387-388 SKILL.md:48 SKILL.md:90 SKILL.md:114 SKILL.md:148 SKILL.md:150 SKILL.md:180 SKILL.md:185 SKILL.md:186 SKILL.md:195 SKILL.md:219 SKILL.md:254 SKILL.md:257 SKILL.md:41-52 SKILL.md:70-102 SKILL.md:112-115 SKILL.md:146-151 SKILL.md:179-181 SKILL.md:184-187 SKILL.md:194-196 SKILL.md:218-220 SKILL.md:252-258
🌐 Network access (8)
📁 Filesystem access (33)
scripts/auth.py:90 scripts/auth.py:93 scripts/auth.py:162 scripts/auth.py:164 scripts/auth.py:180 scripts/auth.py:181 scripts/auth.py:90 scripts/auth.py:93 scripts/auth.py:162 scripts/auth.py:164 scripts/auth.py:180 scripts/auth.py:181 scripts/auth.py:272 scripts/common.py:58 scripts/common.py:58 scripts/skill_cache_cli.py:82 scripts/skill_cache_cli.py:110 scripts/skill_cache_cli.py:82 scripts/skill_cache_cli.py:110 scripts/skill_cache_cli.py:208 scripts/skill_cache_cli.py:158 scripts/skill_cache_cli.py:160 SKILL.md:325 SKILL.md:346 SKILL.md:378 SKILL.md:64 SKILL.md:65 SKILL.md:79 SKILL.md:80 SKILL.md:325 SKILL.md:346 SKILL.md:378 SKILL.md:106
🔑 Env variables (24)
scripts/auth.py:60 scripts/auth.py:70 scripts/auth.py:100 scripts/auth.py:101 scripts/auth.py:102 scripts/auth.py:132 scripts/auth.py:168 scripts/auth.py:187 scripts/auth.py:916 scripts/auth.py:920 scripts/auth.py:924 scripts/auth.py:1020 scripts/common.py:36 scripts/common.py:44 scripts/common.py:60 scripts/common.py:61 scripts/common.py:62 scripts/common.py:77 scripts/issue.py:85 scripts/issue.py:86 scripts/query.py:104 scripts/query.py:105 scripts/skill_cache_cli.py:86 scripts/skill_cache_cli.py:86
⚡ Contains scripts (2)
Detected Patterns
System reconnaissance×10
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/meituan-open-platform-meituan-coupon?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/meituan-open-platform-meituan-coupon?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/meituan-open-platform-meituan-coupon/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/meituan-open-platform-meituan-coupon.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Meituan-Open-Platform. (2026). meituan-coupon security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5BibTeX citation
@techreport{meituan-open-platform-meituan-open-platform-meituan-coupon-2026,
author = {Meituan-Open-Platform},
title = {meituan-coupon security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "meituan-coupon security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "Meituan-Open-Platform"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5"
identifiers:
- type: other
value: "skillstore:meituan-open-platform-meituan-coupon:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 68
Architecture
85
Maintainability
85
Content
69
Community
83
Spec Compliance
What You Can Build
Daily coupon claiming
Claim available Meituan coupons for a user after login and show the coupon details.
Redemption record lookup
Review coupon records for a selected date or date range using saved redemption codes.
Coupon reminder setup
Save a preferred daily coupon time and return platform-specific scheduling details.
Try These Prompts
Claim today coupons
Help me claim any available Meituan coupons for today.
Check login status
Check whether my Meituan coupon login is valid before claiming coupons.
Review a date range
Show my Meituan coupon redemption records from March 20 to March 23.
Set daily claiming
Set up daily Meituan coupon claiming at 10:00 Beijing time and tell me the result.
Best Practices
- Use the skill only after confirming the user wants to log in or claim coupons.
- Keep phone numbers, SMS codes, user tokens, and device tokens out of chat output.
- Review local storage and scheduler settings before enabling automatic daily claiming.
Avoid
- Do not run login or coupon scripts for unrelated shopping or food questions.
- Do not paste full tokens, phone numbers, or SMS codes into visible responses.
- Do not enable recurring coupon claiming without explicit user consent.
Frequently Asked Questions
Does this skill require a Meituan account?
Yes. It requires a registered Meituan account and SMS verification before claiming coupons.
Where are tokens stored?
The bundled scripts store tokens in local cache files under the user workspace.
Does it contact external services?
Yes. It sends requests to Meituan service endpoints to verify login, issue coupons, and query records.
Can it guarantee coupon availability?
No. Coupon results depend on account eligibility, campaign status, quota, and Meituan responses.
Can it claim coupons automatically every day?
It can save a daily claiming preference and return scheduler instructions when the platform supports them.
Is this safe to install without review?
No. It runs scripts, stores authentication data, sends network requests, and can configure recurring actions.
Developer Details
Author
Meituan-Open-PlatformLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
b8ca75d2c0a7e7102978993058777d82b8ab2610
Maintenance freshness
7/18/2026
Usage
22 downloads · 155 views