T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcdonalds-mcp.js:61- Finding
Bearer Token Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
麦当劳MCP服务集成，支持点餐、优惠券、麦麦商城、积分兑换等功能。
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it can use a McDonald's account token to create real orders and exposes that token through command-line usage.
Review this before installing if you plan to use a real McDonald's MCP token. Prefer not to paste tokens directly into shell commands, rotate any token already used that way if exposure is plausible, and require explicit user confirmation before invoking create_order or create_exchange_order.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to make authenticated HTTP requests to an external McDonald's MCP endpoint, but it does not declare any explicit tool scope such as allowed network destinations or permissions. This creates an authorization and containment gap: an agent/runtime may permit broader network access than intended, increasing the risk of token misuse, unexpected outbound requests, or SSRF-like abuse if the skill is extended or interpreted loosely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The descriptive comments, error/help output, and examples are written in Chinese only. This imposes a specific language without any opt-in or alternative, which matches the locale/language policy concern described by SQP-3.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script exposes a create_order method and the example usage includes sending product and address identifiers, which can affect user data and place an order. Although the script logs the API response, it does not provide any user-facing warning, confirmation step, or cautionary comment about this potentially irreversible action.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The code performs an HTTP POST to an external McDonald's endpoint with a Bearer token and arbitrary JSON parameters, which may include address or order information. The file contains usage instructions but no explicit warning that credentials and user-supplied data are sent over the network.
- Content
Static analysis
No suspicious patterns detected.