美团红包助手

Name/description match the scripts: auth.py, issue.py, query.py implement login, issue, and query flows against Meituan endpoints. However, the skill probes and migrates legacy auth/token files across multiple workspace locations and uses a shared cache CLI (.shared/mt_auth_tokens.json) which is broader than a single-skill private store; this cross-skill token access is explainable (to reuse existing login) but is noteworthy and not strictly minimal.

SKILL.md directs the agent to execute local Python scripts, check/modify workspace paths, create platform cron jobs (via CronCreate/RemoteTrigger/openclaw commands), and extract user IDs from inbound context. The scripts perform migrations, read legacy files (~/.xiaomei-workspace, ~/.openclaw/workspace/auth_tokens.json), and write shared cache files. These file and cross-platform scheduling operations expand scope beyond just calling Meituan APIs and could surface or reuse unrelated tokens or create autonomous scheduled actions.

No external install spec; code is shipped with the skill and SKILL.md runs local scripts. No remote downloads or package installation steps were found, so install mechanism risk is low. The runtime still executes subprocesses and writes files (via included CLI), so execution risk exists but installation itself is benign.

The skill requires no declared env vars, but the code reads/writes shared auth/token stores and multiple legacy paths (including other platform default auth files). It will migrate whatever tokens it finds into its shared cache and uses phone_masked/user_token values. Accessing and migrating tokens stored for other skills or in legacy locations is more privilege than expected for a single-purpose coupon retriever and could expose unrelated credentials if present in those locations.

The skill does not set always:true, but it can create persistent scheduled jobs across platforms (cron entries via platform-specific commands) and write persistent data (auth tokens, history) into the user's workspace/.shared cache. This persistence is plausible for an 'auto-claim daily coupon' feature, but it increases the blast radius because the skill can run autonomously at scheduled times and read/write shared token files.