ClawHub
Back to skill

Security audit

mcd-cn

Security checks for vulnerabilities and agentic risk

Overview

This McDonald's helper skill is purpose-aligned but users should treat its token and coupon-claiming actions carefully.

Install only if you are comfortable sending your MCD_TOKEN and McDonald's account-related coupon requests to the configured MCP service. Keep MCD_MCP_URL at a trusted endpoint, avoid exposing the token in logs or shared terminals, and confirm before using one-click coupon claiming because it modifies account state.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest description includes '门店查询' and the changelog repeats support for store lookup, which implies the skill can help users find McDonald's locations. However, the listed tools only cover coupons, campaign calendar, nutrition, and current time; there is no store-search tool, example, or implementation shown anywhere in the file.

External Transmission

Medium
Category
Data Exfiltration
Content
## 调用方式

使用 exec 工具执行 curl 命令调用 MCP 服务：

```bash
MCD_URL="${MCD_MCP_URL:-https://mcp.mcd.cn}"
Confidence
84% confidence
Finding
The skill explicitly directs the agent to use curl to send an Authorization bearer token and user requests to an external service. External transmission is inherent to the skill's purpose, but it still creates a real security boundary: secrets and account-associated data leave the local environment and are exposed to the configured endpoint, especially if MCD_MCP_URL is changed from the default.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill exposes an account-affecting action, auto-bind-coupons, that automatically claims all available coupons without requiring an explicit confirmation step. This is dangerous because an agent may perform a state-changing action from an ambiguous prompt, causing unintended account modifications and surprising the user.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The skill instructs use of a bearer token with a remote service but does not clearly warn that the token is transmitted to an external endpoint and may reveal account-linked data. While the transmission is expected for the feature, insufficient disclosure can mislead users about privacy and trust boundaries when authorizing the skill.

Static analysis

No suspicious patterns detected.