技能 meituan-coupon
📦
meituan-coupon
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量⚡ 包含脚本
领取美团优惠券并跟踪核销记录
用户需要一种引导式方式来领取美团优惠券并查看过去的核销记录。此技能通过捆绑脚本运行优惠券、登录、历史记录和提醒流程。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "meituan-coupon" from https://skillstore.io/skills/meituan-open-platform-meituan-coupon.md and its manifest at https://skillstore.io/api/skills/meituan-open-platform-meituan-coupon/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“meituan-coupon”。 领取我今天的美团优惠券。
预期结果:
该技能会确认登录状态，请求任何缺失的验证信息，然后报告优惠券名称、金额、有效期日期和使用链接。
正在使用“meituan-coupon”。 我昨天领取了哪些优惠券？
预期结果:
该技能会询问或解析日期，检查已保存的核销记录，并汇总匹配的优惠券记录，或说明未找到记录。
正在使用“meituan-coupon”。 提醒我每天早上领取优惠券。
预期结果:
该技能会保存首选时间，识别受支持的调度平台，并返回是否已创建重复任务。
安全审计
高风险v5 • 2026/7/6 打开版本化报告
The audit confirms real risk from bundled Python script execution, local persistence of user tokens and device identifiers, outbound Meituan API calls, and recurring coupon automation. Many static hits are false positives from Markdown backticks, comments, Chinese prose entropy, and dictionary key terminology, but the remaining confirmed findings are security-relevant. This skill should not be auto-installed without explicit user review and publisher verification.
11
已扫描文件
3,849
分析行数
73
复核项
0
已忽略误报
已确认安全问题 (14)
高
System reconnaissance
| 「确认」 / 「好的」 / 「可以」 | 1. 记录定时偏好并获取平台信息:<br>`CRON_RESULT=$($PYTHON "$AUTH_SCRIPT" cron-set --time "1
The instructions create real recurring coupon-claiming jobs and include platform commands that target a user identifier. This is persistent automation and scheduling behavior, not a benign reference.
高
Prompt Injection Attempt Detected
SKILL.md declares “Critical Rules（最高优先级）” and requires the agent to execute scripts on each coupon trigger. Untrusted skill text attempts to set priority and force tool execution.
The text explicitly assigns itself highest priority and constrains outputs while forcing script execution. That matches prompt-injection style control language in an untrusted skill file.
高
Sensitive Authentication Data Collection and Persistence
The skill asks for a phone number and SMS code, receives user_token and device_token values, and persists them in local auth storage. This is a high-risk credential-handling workflow.
The referenced flow directly sends SMS codes and writes returned authentication tokens. The code paths and documentation agree on the credential handling behavior.
高
Recurring Background Coupon Claiming
The skill can create daily scheduled jobs that claim coupons later without per-run confirmation. Persistent background actions increase account and consent risk.
The documentation and code both generate recurring scheduler actions for coupon claiming. The behavior is explicit and not merely inferred from static command patterns.
中
System reconnaissance
> - **Friday 广场**:从会话上下文中的 sender_id 获取
The rule uses conversation or scheduler identifiers to create, update, or delete recurring jobs. This is relevant platform-state handling even if not classic reconnaissance.
中
System reconnaissance
- 「改成8点」/「提醒时间改一下」→ 更新 cron:<br>1. 先查询当前任务ID:`CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)`,解析
The rule uses conversation or scheduler identifiers to create, update, or delete recurring jobs. This is relevant platform-state handling even if not classic reconnaissance.
中
System reconnaissance
"uuid": uuid_val # 设备唯一标识,对接接口 uuid 扩展字段
The code sends a persistent device UUID together with phone or SMS verification data to a remote endpoint. That device identifier is security- and privacy-relevant.
中
System reconnaissance
"uuid": uuid_val # 设备唯一标识,对接接口 uuid 扩展字段
The code sends a persistent device UUID together with phone or SMS verification data to a remote endpoint. That device identifier is security- and privacy-relevant.
显示全部 14 条已确认问题
中
System reconnaissance
user_id = os.environ.get("CLAWHUB_USER_ID") or os.environ.get("USER_ID") or "${USER_ID}"
The code reads a user identifier from the environment and embeds it in a scheduler command target. This is real user-context handling for automation.
中
Official Branding Used During Credential Request
The skill claims it is an official Meituan coupon assistant while asking users to provide phone and SMS verification data. Marketplace publication should verify the publisher before allowing this trust claim.
The official-brand claim and credential request are present in the cited text. The risk is publisher-trust context rather than proof that the claim is false.
低
System reconnaissance
cron_job_id = token_data.get(CRON_JOB_ID_KEY, "")
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
低
System reconnaissance
"cron_job_id": cron_job_id if cron_enabled else None,
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
低
System reconnaissance
"notes": "Agent 需要从 inbound 上下文中获取 sender_id 替换 user_id 占位符"
The note instructs the agent to obtain sender_id from inbound context to replace a scheduler target. This is user-context extraction for automation.
低
System reconnaissance
token_data[CRON_JOB_ID_KEY] = job_id
The code reads or stores scheduler job IDs used to manage recurring tasks. It is not reconnaissance, but it is security-relevant platform state.
能力复核项 (73)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
subprocess.run executes an environment-resolved Python interpreter and local cache CLI while handling authentication cache data. Even without shell=True, it is real external command execution.
高
Hidden file in home directory
4. 默认:~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
- 美团 Skill 统一使用 ~/.xiaomei-workspace/ 作为工作空间
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
2. ~/.xiaomei-workspace/mt_auth_tokens.json(小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
注意:其他潜在历史位置(如 ~/.openclaw/workspace/auth_tokens.json)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
2. ~/.xiaomei-workspace/mt_auth_tokens.json (小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
3. ~/.openclaw/workspace/auth_tokens.json (OpenClaw 默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Python subprocess.run
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
subprocess.run executes the cache CLI from shared helper code used by coupon scripts. It performs real local command execution with inherited environment data.
高
Hidden file in home directory
4. 默认 ~/.xiaomei-workspace(与 skill_cache_cli.py 兼容)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
4. 创建默认路径 ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
default = cls.KNOWN_WORKSPACES[0] # ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
高
Hidden file in home directory
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
高
Hidden file in home directory
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_phone_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
高
Hidden file in home directory
- **认证文件说明**:`~/.xiaomei-workspace/mt_auth_tokens.json` 为美团官方账号认证文件,存储登录令牌和设备标识,仅保存于用户本地设备,权限 0600,符
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
中
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
中
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
中
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
中
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
中
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
中
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The documentation instructs the agent to execute auth.py and parse user_token or phone_masked from shell output. That is real command execution touching sensitive authentication data.
中
Shell command substitution
CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)
The documentation instructs the agent to run auth.py cron-status before managing scheduled coupon claiming. This is real local command execution in the workflow.
中
Hardcoded URL
BASE_URL = "https://peppermall.meituan.com"
This hardcoded endpoint is used by httpx calls for login verification, coupon issue, or coupon history requests. It creates real external network egress carrying account or coupon data.
中
Hidden file access
4. 默认:~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
- 美团 Skill 统一使用 ~/.xiaomei-workspace/ 作为工作空间
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
2. ~/.xiaomei-workspace/mt_auth_tokens.json(小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
注意:其他潜在历史位置(如 ~/.openclaw/workspace/auth_tokens.json)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
2. ~/.xiaomei-workspace/mt_auth_tokens.json (小美搭档默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
3. ~/.openclaw/workspace/auth_tokens.json (OpenClaw 默认)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
"new_path": write_result.get("path", "skills_local_cache/.shared/mt_auth_tokens.json")
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Python environment access
user_id = os.environ.get("CLAWHUB_USER_ID") or os.environ.get("USER_ID") or "${USER_ID}"
The USER_ID environment value is inserted into a generated openclaw cron command target. Environment-controlled scheduling targets are security-relevant.
中
Hardcoded URL
BASE_URL = "https://peppermall.meituan.com"
This hardcoded endpoint is used by httpx calls for login verification, coupon issue, or coupon history requests. It creates real external network egress carrying account or coupon data.
中
Hidden file access
4. 默认 ~/.xiaomei-workspace(与 skill_cache_cli.py 兼容)
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
4. 创建默认路径 ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Hidden file access
default = cls.KNOWN_WORKSPACES[0] # ~/.xiaomei-workspace
The code uses hidden workspace paths under the user home directory for token, cache, or skill data. Hidden local persistence of authentication and coupon data is a real filesystem risk.
中
Python file write/append
with open(file_path, "w", encoding="utf-8") as f:
The cache CLI writes caller-provided content to local cache files. This is expected functionality, but it is still real filesystem write capability.
中
Python os file operations
os.chmod(file_path, stat.S_IRUSR | stat.S_IWUSR)
The code changes local file permissions with os.chmod for cache files. This is real filesystem mutation and should remain reviewable.
中
Shell command substitution
[ -f "$_glob_hit" ] && SKILL_DIR="$(dirname "$_glob_hit")" && break
The shell snippet executes dirname while searching hidden skill directories under the user home directory. The command is fixed, but it is real filesystem-oriented shell execution.
中
Shell command substitution
TERMS_RESULT=$($PYTHON "$AUTH_SCRIPT" terms-check)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
VERIFY_RESULT=$($PYTHON "$AUTH_SCRIPT" token-verify)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
USER_TOKEN=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d['u
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
PHONE_MASKED=$(echo "$VERIFY_RESULT" | $PYTHON -c "import sys,json; d=json.load(sys.stdin); print(d[
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
ISSUE_RESULT=$($PYTHON "$ISSUE_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED")
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
CRON_STATUS=$($PYTHON "$AUTH_SCRIPT" cron-status)
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Shell command substitution
QUERY_RESULT=$($PYTHON "$QUERY_SCRIPT" --token "$USER_TOKEN" --phone-masked "$PHONE_MASKED" --dates
The SKILL.md workflow instructs the agent to execute bundled auth, issue, or query scripts with token-derived arguments. This is real local command execution and should stay in the audit.
中
Hidden file access
> | 3 | `$HOME/.openclaw/skills/` | OpenClaw / CatClaw 沙箱 |
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
中
Hidden file access
> | 4 | `$HOME/.claude/skills/` | Claude 通用 |
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
中
Hidden file access
"$HOME/.openclaw/skills/$SKILL_NAME" \
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
中
Hidden file access
"$HOME/.claude/skills/$SKILL_NAME"; do
The setup instructions search hidden Claude or OpenClaw directories under the home directory to locate the skill. This is real hidden-directory access, although scoped to skill discovery.
中
Hidden file access
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
中
Hidden file access
路径:`~/.xiaomei-workspace/skills_local_cache/meituan-coupon/data/mt_ods_coupon_phone_history.json`
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
中
Hidden file access
- **认证文件说明**:`~/.xiaomei-workspace/mt_auth_tokens.json` 为美团官方账号认证文件,存储登录令牌和设备标识,仅保存于用户本地设备,权限 0600,符
The skill documents hidden home-directory files that store coupon history, user tokens, and device identifiers. This confirms hidden local persistence of sensitive data.
中
Temp directory access
> 💡 如需自定义 Token 存储路径(沙箱/隔离场景):`export XIAOMEI_AUTH_FILE=/tmp/my_auth_tokens.json`
The instruction allows moving the authentication file into /tmp, which can weaken isolation for token material on shared systems. This is a real storage-location risk.
低
Python environment access
env_path = os.environ.get("SKILL_CACHE_CLI_PATH")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python environment access
env_python = os.environ.get("SKILL_CACHE_PYTHON")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python environment access
workspace = os.environ.get("SKILL_CACHE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
or os.environ.get("CLAUDE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
or os.environ.get("XIAOMEI_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
env = os.environ.copy()
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python environment access
env_path = os.environ.get("XIAOMEI_AUTH_FILE")
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
env_path = os.environ.get("XIAOMEI_AUTH_FILE")
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
if os.environ.get("CLAUDE_DESKTOP") or os.environ.get("CLAUDE_CODE"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
低
Python environment access
if os.environ.get("FRIDAY_ENV") or os.environ.get("FRIDAY_SKILL_ID"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
低
Python environment access
if os.environ.get("CLAWHUB_ENV") or os.environ.get("OPENCLAW_AVAILABLE"):
The environment variables select the platform branch used to generate scheduler behavior. This is not secret access, but it can affect how recurring actions are configured.
低
Python environment access
env_path = os.environ.get("SKILL_CACHE_CLI_PATH")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python environment access
env_python = os.environ.get("SKILL_CACHE_PYTHON")
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python environment access
workspace = os.environ.get("SKILL_CACHE_WORKSPACE") \
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python environment access
or os.environ.get("CLAUDE_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
or os.environ.get("XIAOMEI_WORKSPACE") \
The environment value controls workspace or legacy auth file selection for local token storage. This is legitimate configuration but still affects sensitive file placement.
低
Python environment access
env = os.environ.copy()
The environment value can influence which Python executable, cache CLI path, or subprocess environment the skill uses. That makes the access relevant to command execution behavior.
低
Python getenv function
if path := os.getenv(env_var):
The cache CLI reads environment variables to choose or create the workspace path. This is legitimate configuration but affects where data is persisted.
低
getenv function call
if path := os.getenv(env_var):
The cache CLI reads environment variables to choose or create the workspace path. This is legitimate configuration but affects where data is persisted.
风险因素
⚙️ 外部命令 (115)
references/auth-flow.md:67 references/auth-flow.md:78 references/auth-flow.md:79 references/auth-flow.md:126 references/auth-flow.md:127 references/auth-flow.md:128 references/cron-rules.md:14 scripts/auth.py:136 scripts/auth.py:929 scripts/auth.py:37 scripts/common.py:81 scripts/issue.py:12 scripts/query.py:14 SKILL.md:20 SKILL.md:26 SKILL.md:29 SKILL.md:30 SKILL.md:41-52 SKILL.md:52-56 SKILL.md:56-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-67 SKILL.md:67-68 SKILL.md:68 SKILL.md:70-102 SKILL.md:102-104 SKILL.md:104-106 SKILL.md:106-112 SKILL.md:112-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120 SKILL.md:146-151 SKILL.md:151-155 SKILL.md:155 SKILL.md:159 SKILL.md:165-167 SKILL.md:167-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183-184 SKILL.md:184-187 SKILL.md:187-188 SKILL.md:188 SKILL.md:194-196 SKILL.md:196-200 SKILL.md:200-202 SKILL.md:202-203 SKILL.md:203-204 SKILL.md:204-209 SKILL.md:209-216 SKILL.md:216-218 SKILL.md:218-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:223-231 SKILL.md:231 SKILL.md:235-239 SKILL.md:239-252 SKILL.md:252-258 SKILL.md:258-260 SKILL.md:260-264 SKILL.md:264-274 SKILL.md:274-276 SKILL.md:276-278 SKILL.md:278 SKILL.md:287-289 SKILL.md:289-291 SKILL.md:291 SKILL.md:297-303 SKILL.md:303-325 SKILL.md:325-327 SKILL.md:327-337 SKILL.md:337-339 SKILL.md:339-340 SKILL.md:340-341 SKILL.md:341-342 SKILL.md:342-346 SKILL.md:346-348 SKILL.md:348-358 SKILL.md:358-360 SKILL.md:360 SKILL.md:361-367 SKILL.md:367-378 SKILL.md:378-385 SKILL.md:385 SKILL.md:386-387 SKILL.md:387-388 SKILL.md:48 SKILL.md:90 SKILL.md:114 SKILL.md:148 SKILL.md:150 SKILL.md:180 SKILL.md:185 SKILL.md:186 SKILL.md:195 SKILL.md:219 SKILL.md:254 SKILL.md:257 SKILL.md:41-52 SKILL.md:70-102 SKILL.md:112-115 SKILL.md:146-151 SKILL.md:179-181 SKILL.md:184-187 SKILL.md:194-196 SKILL.md:218-220 SKILL.md:252-258
🌐 网络访问 (8)
📁 文件系统访问 (33)
scripts/auth.py:90 scripts/auth.py:93 scripts/auth.py:162 scripts/auth.py:164 scripts/auth.py:180 scripts/auth.py:181 scripts/auth.py:90 scripts/auth.py:93 scripts/auth.py:162 scripts/auth.py:164 scripts/auth.py:180 scripts/auth.py:181 scripts/auth.py:272 scripts/common.py:58 scripts/common.py:58 scripts/skill_cache_cli.py:82 scripts/skill_cache_cli.py:110 scripts/skill_cache_cli.py:82 scripts/skill_cache_cli.py:110 scripts/skill_cache_cli.py:208 scripts/skill_cache_cli.py:158 scripts/skill_cache_cli.py:160 SKILL.md:325 SKILL.md:346 SKILL.md:378 SKILL.md:64 SKILL.md:65 SKILL.md:79 SKILL.md:80 SKILL.md:325 SKILL.md:346 SKILL.md:378 SKILL.md:106
🔑 环境变量 (24)
scripts/auth.py:60 scripts/auth.py:70 scripts/auth.py:100 scripts/auth.py:101 scripts/auth.py:102 scripts/auth.py:132 scripts/auth.py:168 scripts/auth.py:187 scripts/auth.py:916 scripts/auth.py:920 scripts/auth.py:924 scripts/auth.py:1020 scripts/common.py:36 scripts/common.py:44 scripts/common.py:60 scripts/common.py:61 scripts/common.py:62 scripts/common.py:77 scripts/issue.py:85 scripts/issue.py:86 scripts/query.py:104 scripts/query.py:105 scripts/skill_cache_cli.py:86 scripts/skill_cache_cli.py:86
⚡ 包含脚本 (2)
检测到的模式
System reconnaissance×10
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/meituan-open-platform-meituan-coupon?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/meituan-open-platform-meituan-coupon?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/meituan-open-platform-meituan-coupon/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/meituan-open-platform-meituan-coupon.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
Meituan-Open-Platform. (2026). meituan-coupon security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5BibTeX 引用
@techreport{meituan-open-platform-meituan-open-platform-meituan-coupon-2026,
author = {Meituan-Open-Platform},
title = {meituan-coupon security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "meituan-coupon security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "Meituan-Open-Platform"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/meituan-open-platform-meituan-coupon/audits/5"
identifiers:
- type: other
value: "skillstore:meituan-open-platform-meituan-coupon:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 68
架构
85
可维护性
85
内容
69
社区
83
规范符合性
你能构建什么
每日领券
在用户登录后领取可用的美团优惠券，并显示优惠券详情。
核销记录查询
使用已保存的核销码查看所选日期或日期范围内的优惠券记录。
优惠券提醒设置
保存首选的每日领券时间，并返回特定平台的调度详情。
试试这些提示
领取今日优惠券
帮我领取今天所有可用的美团优惠券。
检查登录状态
在领取优惠券前，检查我的美团优惠券登录是否有效。
查看日期范围
显示我从 3 月 20 日到 3 月 23 日的美团优惠券核销记录。
设置每日领取
设置每天北京时间 10:00 自动领取美团优惠券，并告诉我结果。
最佳实践
- 仅在确认用户想要登录或领取优惠券后使用该技能。
- 不要在聊天输出中显示手机号、短信验证码、用户令牌和设备令牌。
- 在启用每日自动领取前，检查本地存储和调度器设置。
避免
- 不要针对无关的购物或餐饮问题运行登录或优惠券脚本。
- 不要在可见响应中粘贴完整令牌、手机号或短信验证码。
- 未经用户明确同意，不要启用重复领券。
常见问题
此技能需要美团账户吗？
是。领取优惠券前需要注册的美团账户并完成短信验证。
令牌存储在哪里？
捆绑脚本会将令牌存储在用户工作区下的本地缓存文件中。
它会联系外部服务吗？
是。它会向美团服务端点发送请求，以验证登录、发放优惠券和查询记录。
它能保证优惠券可用吗？
不能。优惠券结果取决于账户资格、活动状态、配额和美团响应。
它可以每天自动领取优惠券吗？
它可以保存每日领券偏好，并在平台支持时返回调度器说明。
不经检查就安装它安全吗？
不能。它会运行脚本、存储身份验证数据、发送网络请求，并且可以配置重复操作。