麦当劳点餐

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:40 PM UTC
• Version: 1.0.0

Overview

This skill is coherent, but it can use a McDonald's account token to place orders, redeem points, claim coupons, and handle delivery addresses without clear confirmation safeguards.

Review this skill before installing. Only use it with a McDonald's China account token you control, and require explicit confirmation before placing orders, redeeming points, creating addresses, or bulk claiming coupons. Treat delivery addresses and phone numbers as sensitive personal data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        return {"error": f"HTTP {e.code}: {e.read().decode('utf-8')}"}

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The create-order tool can place a real food delivery order that may charge the user and alter account state, yet the documentation does not warn that this is a live purchase action. In an autonomous or semi-autonomous agent workflow, this can lead to unauthorized spending or unintended orders if invoked without an explicit confirmation barrier.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The mall-create-order tool creates a points redemption order that may irreversibly spend user loyalty points, but the documentation omits any warning about the irreversible account impact. For agent-driven flows, this creates a significant risk of unauthorized or accidental depletion of stored value.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents use of an environment token and outbound network access to a third-party MCP server, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host agent may permit broader capabilities than the skill actually needs, increasing the risk of unintended secret access or network actions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to activate on generic mentions of 麦当劳, McDonald's, coupons, points, or ordering, without requiring clear user intent to perform an account-affecting action. In practice this can cause the skill to activate in conversational contexts where the user only wants information, increasing the chance of unnecessary access to account data or progression toward sensitive actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automated coupon claiming, account queries, address retrieval, order creation, and points redemption, all of which can change user account state or expose personal data, but it does not warn the user or require explicit confirmation. In this context, the skill is more dangerous because it is tied to a real consumer account and supports transactional operations that could spend points, submit orders, or reveal saved addresses.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The auto-bind-coupons tool performs a bulk account-modifying action by claiming all available coupons, but the documentation does not warn users or agent developers about this side effect. Bulk actions are risky in agent contexts because they can unexpectedly change account inventory, trigger rate limits, or interfere with future user choices.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents creation of delivery addresses using sensitive personal data such as contact name, phone number, and full address, but provides no warning that this is real account-state-changing PII handling. In an agent setting, that omission increases the risk of collecting, storing, or submitting user data without explicit informed consent, which can cause privacy harm and unintended account changes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code file performs an HTTP POST to a remote MCP endpoint, transmitting the selected tool name and arbitrary JSON arguments, authenticated with a bearer token. While the script has a basic usage string, it does not warn users that provided arguments may be sent to an external service or that authenticated account data may be involved.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: User-facing strings in the docstring and CLI help are presented only in Chinese, with no option to select another language or indication that the tool is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.