美团C端用户Agent认证工具

美团C端用户Agent认证工具。为需要美团用户身份的 Skill（如发券、查订单等）提供手机号验证码登录认证，管理用户Token，实现“一次认证、持续有效”。当其他 Skill 需要校验用户身份、获取用户Token时，作为前置认证模块调用。触发词：美团登录、用户认证、手机号验证、发送验证码、获取Token、切换账...

This skill implements Meituan SMS login and token storage, but it will automatically scan for legacy auth files in multiple locations (including ~/.openclaw and other workspaces) and may copy entire legacy JSON content into a shared mt_auth_tokens.json used by other skills. Before installing or running it: - Consider running it in an isolated/sandboxed agent or set XIAOMEI_AUTH_FILE to a path you control (e.g. /tmp/my_auth_tokens.json) so it won't touch your normal workspace. - Alternatively set SKILL_CACHE_WORKSPACE or SKILL_CACHE_CLI_PATH to an isolated directory so the skill_cache_cli operates on a safe location. - Inspect the full auth.py and skill_cache_cli.py yourself (they are bundled) — pay attention to the migration logic that writes legacy JSON wholesale; ideally request the maintainer to change migration to only copy this skill's AUTH_KEY instead of the entire file. - Be aware the skill will store tokens on disk in a shared cache that other skills can read; if you have sensitive tokens from other skills, avoid automatic migration or isolate the workspace. - If you need a safer alternative, ask the author for an explicit opt-in migration flag (instead of automatic), or for clearer guarantees that unrelated keys/files will not be read or migrated. Given these behaviors I recommend treating the skill as potentially risky unless you apply workspace isolation or get code changes that limit migration scope.

Type: OpenClaw Skill Name: meituan-c-user-auth Version: 1.0.8 The skill bundle provides a legitimate authentication and token management utility for Meituan services. It handles SMS-based login and local storage of user tokens in a dedicated workspace (~/.xiaomei-workspace), implementing security best practices such as restricted file permissions (0600) and explicit instructions for the AI agent to avoid displaying sensitive tokens in the chat interface. The code communicates exclusively with official Meituan domains (peppermall.meituan.com) and includes a transparent scheduling feature (cron-set) intended for automated coupon collection, which utilizes platform-native scheduling commands rather than unauthorized persistence mechanisms.