ClawHub
Back to skill

Security audit

Mcdonald - 麦当劳助手

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it uses an account token for remote requests and can change coupon account state without a required confirmation step.

Review this before installing. Use it only if you trust the MCP service and token issuer, avoid setting MCD_MCP_URL unless it is an explicitly trusted HTTPS endpoint, and confirm manually before allowing coupon-claiming actions that modify your account.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:28
Finding

Bearer Token Disclosure Through a User-Configurable MCP Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–41
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

The Skill permits MCD_MCP_URL to control the destination of authenticated requests. It then sends the user's MCD_TOKEN to that destination as an HTTP bearer credential.

bash
# Optional configuration documented at line 28:
# MCD_MCP_URL: MCP service address, default https://mcp.mcd.cn

MCD_URL="${MCD_MCP_URL:-https://mcp.mcd.cn}"
MCD_AUTH="Authorization: Bearer ${MCD_TOKEN:-<YOUR_TOKEN>}"

curl -s -X POST "$MCD_URL" \
  -H "$MCD_AUTH" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"<tool name>","arguments":{<parameters>}},"id":1}'

Technical Analysis

MCD_MCP_URL is accepted without validating its scheme or hostname. The bearer authorization header is attached to the request regardless of whether the selected endpoint is the intended https://mcp.mcd.cn service.

If an attacker can influence the agent's environment or convince a user to configure a malicious endpoint, the prescribed command will transmit MCD_TOKEN directly to that endpoint. An HTTP URL could additionally expose the credential to network interception. The default endpoint is HTTPS and appears legitimate; exploitation therefore depends on modifying the optional configuration rather than the default behavior.

Attack Path

  1. The victim obtains a valid MCD_TOKEN and makes it available to the agent.
  2. An attacker, compromised configuration, or unsafe setup instruction sets MCD_MCP_URL to an attacker-controlled URL.
  3. The victim requests any documented MCP operation, such as listing available coupons.
  4. The agent follows the Skill instructions and executes curl against the configured URL.
  5. The request includes Authorization: Bearer ${MCD_TOKEN}.
  6. The attacker-controlled server records the bear ...[truncated 521 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove endpoint configurability if custom MCP deployments are not required, and always send authenticated requests to https://mcp.mcd.cn.
  2. If configurability is necessary, parse and validate the URL before sending credentials:
    • Require the https scheme.
    • Maintain an explicit allowlist of trusted hostnames.
    • Reject embedded user information, unexpected ports, IP literals, and deceptive hostname suffixes.
  3. Do not attach the authorization header until the destination has passed validation.
  4. Keep redirects disabled for credential-bearing requests, or validate every redirect destination before forwarding authorization headers.
  5. Use a dedicated MCP client or credential broker that binds tokens to an approved origin instead of constructing authenticated requests through a general-purpose shell command.
  6. Document that changing MCD_MCP_URL can disclose the token and should only be done for explicitly trusted endpoints.
  7. Limit token lifetime and privileges, support prompt revocation, and rotate any token suspected of having been sent to an untrusted endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill says to use itself whenever the user asks anything McDonald's-related, which is broader than the concrete capabilities listed. This can cause unintended invocation and unnecessary external requests, including use of authentication context, for queries that could be answered locally or that do not require account-linked actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill instructs use of exec to run curl against an external endpoint and transmit a bearer token in the Authorization header. Any external transmission of secrets or authenticated requests expands the attack surface, and the risk is increased further because the endpoint can be overridden by the configurable MCD_MCP_URL variable, enabling token exfiltration to an attacker-controlled host if misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

调用方式

使用 exec 工具执行 curl 命令调用 MCP 服务：

bash
MCD_URL="${MCD_MCP_URL:-https://mcp.mcd.cn}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes a one-click 'auto-bind-coupons' action that changes the user's account state, but it does not require an explicit confirmation step immediately before execution. This is dangerous because a casual request or broad trigger could result in unintended coupon claiming on the user's account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Nutrition triggers such as '热量', '卡路里', and '多少大卡' are very broad and may match many general food or health questions that are not specifically about McDonald's. This increases the chance of accidental tool execution and unnecessary transmission of authenticated requests to the remote MCP service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The skill description and operating instructions are presented entirely in Chinese and imply a fixed Chinese-language interaction model, but they do not state that language is optional or user-selectable. This can be a locale/language policy issue when a skill effectively forces one language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.