McDonald's China (mstore)

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:12 PM UTC
• Version: 1.0.0

Overview

The skill matches its McDonald's China account purpose, but setup handles the account token unsafely and the skill can perform account-changing actions without clear confirmation rules.

Review before installing. Do not run the setup script as written unless you accept storing a McDonald's China account token in plaintext shell profiles; prefer a session-only environment variable or protected credential storage. Confirm manually before any coupon claim, points redemption, address creation, or food order, and install the CLI only from a source and version you trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:14

Finding

Unsafe Token Handling Enables Credential Disclosure and Shell Profile Injection

Content

View full analysis

/dev/null; then echo "" echo "⚠️ Token already configured in $SHELL_PROFILE" echo "Updating existing entry..." sed -i '' "s|export MCDCN_MCP_TOKEN=.*|export MCDCN_MCP_TOKEN=\"$TOKEN\"|" "$SHELL_PROFILE" else # Add to profile if [ -n "$SHELL_PROFILE" ]; then echo "" >> "$SHELL_PROFILE" echo "# McDonald's China MCP Token" >> "$SHELL_PROFILE" echo "export MCDCN_MCP_TOKEN=\"$TOKEN\"" >> "$SHELL_PROFILE" echo "✅ Token added to $SHELL_PROFILE" fi fi # Also export for current session export MCDCN_MCP_TOKEN="$TOKEN" echo "" echo "✅ Setup complete!" echo "" echo "To use immediately in current terminal:" echo " export MCDCN_MCP_TOKEN=\"$TOKEN\"" ``` ### Technical Analysis The setup script accepts the MCP bearer token through an ordinary `read` operation rather than silent input, causing the secret to remain visible while entered. It subsequently prints the complete token back to the terminal and stores it in plaintext in a shell startup file. The token is interpolated directly into an `echo` command and a double-quoted `sed` replacement without validation or shell-safe encoding. Tokens containing quotation marks, newline characters, command substitutions, or other shell syntax can alter the generated prof ...[truncated 1842 chars]

Remediation

View remediation

"$HOME/.mcd-cn.env" chmod 600 "$HOME/.mcd-cn.env" ``` 6. Serialize values using a shell-safe mechanism instead of directly interpolating them into executable profile content. Avoid dynamically constructed `sed` commands containing untrusted values. 7. Do not automatically modify shell startup files. If environment integration is required, add only a fixed command that reads a protected credential file. 8. Review and remove any existing exposed tokens from shell profiles and terminal logs, then revoke and regenerate affected tokens. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:111

Finding

Unpinned CLI Installation from a Third-Party Homebrew Tap

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'headers' from os.environ.get (line 41, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mcd.py (reported line 56)May include surrounding context.

python

}
    }
    
    response = requests.post(url, headers=headers, json=payload, timeout=30)
    
    if response.status_code == 401:
        print("Error: Invalid or expired token", file=sys.stderr)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mcd.py (reported line 17)May include surrounding context.

python

MCP_VERSION = "2025-06-18"

def get_token():
    """Get MCP token from environment or .env file"""
    token = os.environ.get("MCDCN_MCP_TOKEN")
    if not token:
        # Try to read from .env file

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The code falls back to reading a bearer token from a predictable plaintext file in the user's home directory (~/.mcd-cn.env). If local file permissions are weak, the host is multi-user, or malware gains user-level file access, the token can be stolen and then used to query coupons, points, account data, or place actions against the linked McDonald's account.

Content

Scanner excerpt · scripts/mcd.py (reported line 20)May include surrounding context.

python

"""Get MCP token from environment or .env file"""
    token = os.environ.get("MCDCN_MCP_TOKEN")
    if not token:
        # Try to read from .env file
        env_file = os.path.expanduser("~/.mcd-cn.env")
        if os.path.exists(env_file):
            with open(env_file) as f:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises direct access to account-linked McDonald's services and instructs the user to set a secret token in the environment, but it does not declare any explicit tool scope such as allowed tools or permissions. That mismatch increases the risk that an agent may invoke environment or network capabilities more broadly than the user expects, especially in a skill that can place orders and redeem points.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description presents the skill as a convenience feature but does not clearly warn that it can perform account-affecting actions such as auto-claiming coupons, redeeming points, adding addresses, and creating delivery orders. In an agent setting, users may interpret 'query' and 'check' capabilities as read-only, so missing disclosure raises the risk of unintended transactions or account changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup section instructs the user to obtain and export an account-linked MCP token, but it does not warn that the token is a credential that should be kept secret. Because the token is tied to the user's McDonald's account and the skill supports ordering and redemption, exposure of this token could enable unauthorized account access and transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented auto-bind-coupons action performs an account-changing operation automatically and the reference provides no confirmation or consent guidance. In an agent setting, this increases the risk of unintended user-impacting actions, especially if the agent invokes the tool proactively or under ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delivery address APIs expose and create sensitive personal data including contact names, phone numbers, and full addresses, yet the documentation includes no privacy handling guidance, minimization rules, or consent requirements. In an agent-integrated environment, this raises the risk of unnecessary collection, overexposure in responses/logs, and misuse of personally identifiable information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mcd.py (reported line 56)May include surrounding context.

python

}
    }
    
    response = requests.post(url, headers=headers, json=payload, timeout=30)
    
    if response.status_code == 401:
        print("Error: Invalid or expired token", file=sys.stderr)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persists a sensitive MCP token into the user's shell startup file, which increases exposure by leaving long-lived credentials in plaintext on disk. Any local user, backup system, malware, or later debugging/logging workflow that can read the profile may recover the token, and the script does not warn the user about this persistence or offer a safer temporary option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script prints the full token in the terminal as part of the suggested export command, which can expose the credential through terminal scrollback, session recordings, shared screens, logging, or copied shell history. Because this skill grants direct access to McDonald's China MCP services, token disclosure could let an attacker access coupons, points, or ordering functions tied to the user's account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file is presented as an API reference for McDonald's China and multiple example responses and field-value conventions are only in Chinese, with no indication that users may choose another language or locale. This can be a natural-language policy issue when a skill effectively imposes a specific language without opt-in or an explicit documented locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description enumerates coupon redemption/query, points balance and redemption, campaign calendar, and delivery ordering as the skill's purpose. The documented tool set also includes a separate nutrition capability that exposes menu nutrition data, which is not mentioned or clearly implied by that stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The module docstring repeatedly specifies "McDonald's China" services, which indicates the skill is scoped to a specific locale. For policy review, locale restrictions should be clearly justified or offered as an explicit user choice; this file does not provide either.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

These instructions explicitly direct the user to click Chinese-language UI labels ('控制台' and '激活'), which imposes a specific locale in the guidance. There is no opt-in, alternative language guidance, or justification that the tool is limited to a Chinese-only interface.

Content

No source excerpt is available for this finding.