Mcdonald - 麦当劳助手

• Analyzed: May 12, 2026, 3:27 AM
• Findings: 1
• Version: 1.0.1
• Hash: 99c9de2382e5135f388b9387338ac9c03af92aae98049da5dbbf7ad89c9f4cdb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is classified as benign. The `SKILL.md` file defines a McDonald's assistant that interacts with a specified MCP service (`https://mcp.mcd.cn` by default) using `curl` commands. All network calls are directed to this service, and the `MCD_TOKEN` environment variable is used for authentication to this intended service, not for exfiltration. There is no evidence of prompt injection instructions against the agent, malicious execution, data exfiltration to unauthorized endpoints, persistence mechanisms, or obfuscation. The skill's behavior is clearly aligned with its stated purpose of querying and managing McDonald's related information.