mcd-mcp-skills

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:17 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says, but it can create real McDonald's account actions and handle delivery personal information with insufficient built-in safeguards.

Install only if you are comfortable giving this skill a McDonald's MCP token and letting it act on that account. Require explicit user confirmation before creating addresses, creating delivery orders, claiming coupons in bulk, or redeeming points, and avoid putting addresses, phone numbers, or coordinates directly in shell commands or persisted agent logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcd_mcp_client.py:387

Finding

Sensitive Personal Information Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a local Python client that uses environment credentials and network/MCP capabilities, but the manifest does not declare any tool scope restrictions such as allowed tools or permissions. This weakens least-privilege controls and can allow broader-than-expected execution paths if the skill is loaded by an agent runtime that relies on declarative scoping for enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are broad enough to match ordinary McDonald's-related conversation, including informational queries and transactional intents. In an agent environment, this increases the chance of accidental activation of a skill that can access account data, addresses, coupons, and ordering flows, potentially causing unintended data access or account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The address creation step collects sensitive personal data including detailed address, geolocation, contact name, and phone number, but the documentation does not prominently warn that this information will be submitted to a third-party service. Without an explicit privacy notice and consent checkpoint, users may disclose more personal information than they realize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Creating a delivery order is a real-world transactional action that sends order and delivery information to a third party and can lead to financial consequences or unwanted deliveries. The skill describes the mechanics of order creation but does not clearly require an explicit final confirmation or warn the user that their personal and order data will be transmitted externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The one-click coupon claim feature performs a bulk state-changing operation on the user's account, but the documentation does not warn that it will automatically claim all eligible coupons. This can surprise users, alter account state without informed consent, and potentially affect later coupon eligibility or user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing documentation is presented only in Chinese, and the content is framed around China-specific usage without stating that the skill is region- or locale-limited or offering an alternative language. Under the language/locale policy, a forced language without opt-in or clear justification can be a policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delivery-create-address tool requires sensitive personal data including a full address, contact name, phone number, and precise coordinates, but the reference omits any privacy or data-handling warning. This can lead an agent to request, store, or submit unnecessary personal information without clearly signaling the sensitivity of the action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes create-order as a normal workflow step and highlights that it returns a payment link, but it does not explicitly warn that invoking the tool creates a real external-food-delivery order tied to the user's account. In an agent setting, this increases the risk of unintended real-world transactions if the model acts without a clear confirmation boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

auto-bind-coupons performs a bulk, account-affecting action by automatically claiming all available coupons, yet the documentation presents it as routine and warning-free. In an autonomous-agent context, this can trigger irreversible or user-visible account changes without the user understanding the scope of the action.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mcd_mcp_client.py (reported line 74)May include surrounding context.

python

}
        
        try:
            response = requests.post(
                url,
                headers=self.headers,
                json=payload,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The CLI exposes actions that create delivery addresses and place orders using personal data and account-linked credentials, but it provides no explicit confirmation, consent prompt, or dry-run visibility before transmitting that data to the remote MCP service. In an agent-skill context, this increases the risk of unintended purchases or disclosure of address/contact information if the tool is invoked automatically or with misunderstood user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The points redemption flow performs an account-affecting, potentially irreversible action immediately from the CLI without a warning or confirmation step. In a skill/agent environment, that creates a real risk of accidental point redemption triggered by ambiguous prompts, automation mistakes, or misuse of an authenticated token.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

文件中的名称、描述、任务说明、示例和交互文本均固定为中文，且没有提供用户可选择语言的说明。若该技能面向通用用户环境，这构成了默认语言被强制设定而无显式 opt-in 的自然语言策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.