美团外卖红包

【美团官方】美团外卖红包助手，支持外卖、餐饮团购、酒店住宿、门票度假、休闲娱乐、闪购、医药等多品类优惠券/红包/神券的一键领取与历史领取记录查询。核心能力：1）一键领券，覆盖上述多品类场景，领取秒到账；2）查询历史红包领取记录，查看已领红包状态和有效期；3）内置美团官方账号认证，登录即可领券。重要说明：如存在多个...

Key points before installing or enabling this Skill: - Source trust: The package has no homepage and an unknown source owner. Only install if you trust the publisher. - Local code execution: The skill includes Python scripts that will be executed locally (auth.py, issue.py, query.py, skill_cache_cli.py). Review them before running. - Token migration: auth.py explicitly scans for and may migrate legacy auth/token files (e.g. ~/.xiaomei-workspace/*, ~/.openclaw/workspace/auth_tokens.json) into its own shared cache (mt_auth_tokens.json). This can expose tokens for other skills/services to this skill's storage — if you use multiple skills that store tokens locally, be cautious. - Sensitive data handling: The skill requests/handles phone numbers and user_tokens and will write tokens and coupon history to local files. It claims not to upload sensitive values to third parties, but it will contact Meituan endpoints (peppermall.meituan.com) for issuing/querying coupons. If you are uncomfortable, do not provide real credentials or phone numbers. - Cron/task creation: If you enable automatic daily claiming, the skill instructs creating platform cron jobs (platform-specific commands). These actions will persist external scheduled jobs tied to your account/environment. - Mitigations: If you consider trying it, run it in an isolated environment (sandbox or throwaway account), inspect scripts for any endpoints or unexpected behavior, back up existing auth files, and/or set SKILL_CACHE_WORKSPACE to a dedicated workspace to avoid scanning/migrating unrelated token files. If you cannot audit the code, avoid granting it access to production tokens or primary phone numbers. Summary recommendation: functionally coherent for Meituan coupon workflows, but the automatic scanning/migration of local auth files and persistent centralization of tokens is a disproportionate behavior — treat as suspicious unless you can audit and isolate its execution.

Type: OpenClaw Skill Name: meituan-waimai-coupon Version: 1.0.7 The skill provides a Meituan coupon assistant with automated collection features. It contains several high-risk capabilities, including managing sensitive authentication tokens (SMS-based login in auth.py), establishing persistence via scheduled tasks (openclaw cron in references/cron-rules.md), and a bundled filesystem utility (skill_cache_cli.py) that allows the agent to read, write, and delete files within its workspace. While these behaviors are aligned with the stated purpose and the instructions include explicit security constraints (e.g., Rule 9 in SKILL.md prohibiting privacy exfiltration), the combination of credential management and automated execution represents a significant attack surface. No evidence of intentional malice or unauthorized data exfiltration was observed.