Security audit

mcdonalds-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using McDonald's MCP, but it gives broad live account/order authority and can send the bearer token to a custom endpoint without enough safeguards.

Review this before installing if you will use a real McDonald's MCP token. Prefer the default https://mcp.mcd.cn endpoint, avoid custom URLs, and do not run create-order, delivery-create-address, auto-bind-coupons, or mall-create-order unless you intentionally want live account changes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mcd_cli.py:125
Finding: Bearer Token Can Be Transmitted to an Arbitrary Network Endpoint
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
这个技能提供了一个本地 CLI（`scripts/mcd_cli.py`），支持：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- `SKILL.md`：技能说明

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents capabilities that involve network access, environment-variable token use, and writing output files, but it does not declare any explicit tool scope or permissions boundaries. That omission increases the chance that an agent or user invokes broader side-effecting behavior than expected, especially when the skill can contact a remote service and persist results locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The smoke-test is described as a convenience validation flow, but it explicitly performs a real tool invocation against the remote service without a strong warning about possible side effects. Because the fallback tool selection can hit account-affecting coupon functionality, users may trigger unintended live actions while expecting a harmless connectivity check.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented supported operations include actions such as creating real orders and delivery addresses, but the skill does not prominently warn that these are live, state-changing operations against a production remote service. In an agent setting, this can lead to unintended purchases, account changes, or privacy-impacting writes if a user or automation assumes the examples are read-only tests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This code creates directories and writes a report file when --out is provided, but there is no confirmation prompt or visible user-facing warning near the write operation itself. Although the CLI flag implies output, the code does not explicitly disclose that it may create parent directories as a side effect.
Content: No source excerpt is available for this finding.