Is meituan-travel safe to install?

meituan-travel was flagged as LOW RISK (risk score 2) with 1 finding detected across 11 files. Review the findings before installing.

What security issues were found in meituan-travel?

Sigil detected 1 finding in meituan-travel, including patterns related to install_hooks. See the full scan report for details.

Scans/clawhub/meituan-travel

meituan-travel

clawhub

Summary

meituan-travel v1.0.12 was classified as LOW RISK with a risk score of 2. Sigil detected 1 finding across 11 files, covering phases including install hooks. Review the findings below before installing this package.

Package description: 美团酒旅官方 Skill，您的专属 AI 旅行管家。酒店、机票、火车票、景点门票、度假一站搞定，还能帮你找优惠、比价格、定行程。美团海量真实点评加持，出行每一步都更放心。

LOW RISK(2)

v1.0.12

3 September 2026, 12:05 UTC

by Sigil Bot

Risk Score

Findings

Files Scanned

Provenance

Registry

https://clawhub.com/skills/meituan-travel

Scanned From

https://clawhub.ai/api/v1/download?slug=meituan-travel&version=1.0.12

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

meituan-passport-user-auth/reference.md:137

macOS（推荐 nvm）：
  curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
  nvm install 18

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/meituan-travel)](https://sigilsec.ai/scans/41D3FB05-CED3-47BE-BF0E-D367EA945ECD)

HTML

<a href="https://sigilsec.ai/scans/41D3FB05-CED3-47BE-BF0E-D367EA945ECD"><img src="https://sigilsec.ai/badge/clawhub/meituan-travel" alt="Sigil Scan"></a>

Run This Scan Yourself