ClawHub
Back to skill

Security audit

McDonald's China MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned for McDonald's China account operations, but it under-discloses that it can trigger account-changing actions like orders, addresses, coupons, and points redemption.

Review before installing. Use this skill only if you are comfortable letting an agent operate your connected McDonald's China account through OOMOL, and require explicit confirmation for any action that creates an order, changes an address, claims coupons, or redeems points. Treat it as a read/write account connector, not a read-only search skill.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest claims the skill is only for 'searching and reading data', but the body explicitly documents state-changing capabilities such as creating addresses, claiming coupons, redeeming points, and creating orders. This mismatch can cause downstream agents or reviewers to treat the skill as read-only and invoke it in contexts where write operations should be blocked or require stronger confirmation, enabling unintended account actions.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The safety section says untagged actions are reads, yet `call_tool` is untagged even though its own description allows operations that create addresses, claim coupons, redeem points, or create orders. This inconsistent labeling weakens safety guarantees and may lead an agent to run a mutating operation without applying the extra confirmation logic expected for write actions.

Static analysis

No suspicious patterns detected.