【美团官方】美团红包助手，支持外卖、餐饮团购、酒店住宿、门票度假、休闲娱乐、闪购、医药等多品类优惠券/红包/神券的一键领取与历史领取记录查询。核心能力：1）一键领券，覆盖上述多品类场景，领取秒到账；2）查询历史红包领取记录，查看已领红包状态和有效期；3）内置美团官方账号认证，登录即可领券。重要说明：如存在多个美团...
Security Analysis
medium confidenceThe skill mostly does what it claims (Meituan coupon issuance/query), but it probes and migrates local auth files and a shared workspace area (potentially touching other skills' token files), which is broader than the stated scope and warrants caution.
The code implements issuing and querying coupons against Meituan endpoints (BASE_URL peppermall.meituan.com), and includes local auth and cache management that align with the described purpose. However, the code also enumerates and reads legacy token files in other locations (e.g. ~/.openclaw/workspace/auth_tokens.json, other Skill dirs) to 'migrate' tokens — this is not obviously required strictly to issue coupons for the current user and is broader than the SKILL.md claims.
SKILL.md and scripts instruct the agent to scan/auto-detect many platform-specific directories (globbing $HOME/.*/skills/...), read/write shared cache files, and run bundled Python scripts that will read local token files. The instructions explicitly permit migration from legacy/auth files and rely on reading/writing local persistent token/history files. That scope goes beyond simple single-skill behavior because it accesses other candidate locations and shared caches.
No external install/downloads are used; the skill is instruction + bundled Python scripts. There is no network-mounted install or obscure URL fetch in the manifest. Installation will place/enable the included scripts on disk (they are present in the package).
The manifest declares no required env vars, but the code reads many environment variables and standard workspace paths (SKILL_CACHE_WORKSPACE, CLAUDE_WORKSPACE, XIAOMEI_WORKSPACE, XIAOMEI_AUTH_FILE, etc.). The skill will create/modify shared files under a workspace (.shared/mt_auth_tokens.json and other history files) and attempts to migrate tokens from legacy paths. Accessing or migrating other skills' auth/token files is disproportionate to a minimal coupon helper and creates privacy/credential risk.
always:false and model invocation allowed (normal). The skill persists tokens and history to a shared cache area and can save cron job IDs and instruct CronCreate/openclaw commands (if user opts). Persisting its own auth data is expected, but sharing a public '.shared' mt_auth_tokens.json (cross-skill) and auto-migration behavior is privileged compared with a strictly private skill.
Guidance
This skill appears to implement Meituan coupon issuance and local auth management, but it will scan multiple user directories and migrate token files into a shared workspace (.shared/mt_auth_tokens.json). Before installing or running it: 1) consider running the skill in an isolated account or sandbox (not your primary environment); 2) inspect the bundled scripts yourself (they’re included) — pay attention to any paths referenced (e.g. ~/.openclaw, ~/.xiaomei-workspace); 3) if you have other skills that store tokens in the listed legacy paths, be aware this skill may read/migrate them into its shared cache; 4) avoid setting SKILL_CACHE_WORKSPACE or related env vars to point to sensitive directories; 5) decline enabling automatic cron scheduling unless you trust the environment and understand which platform commands will be executed; 6) if you proceed, check the resulting mt_auth_tokens.json and history files and remove/migrate any unwanted entries, and revoke tokens if you see unexpected data. If you want a lower-risk alternative, ask for a version that keeps auth strictly private (no migration or shared cache access).
Latest Release
v1.0.18
- 新增 SkillHub 元信息字段（metadata），包括 creator、updater、version、source、skill_id、high_sensitive 等。 - 其他功能和操作说明保持不变，无功能改动。 - 版本号保持 1.0.35，仅 metadata 有更新。
Popular Skills
Published by @meituan-zhengchang on ClawHub
