ClawHub

My Mcdonald

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: it uses a McDonald's token to look up and claim coupons, but claiming coupons changes your account and should require clear confirmation.

Install only if you are comfortable giving the agent a McDonald's MCP token. Keep MCD_TOKEN private, leave MCD_MCP_URL pointed at the trusted McDonald's endpoint unless you intentionally trust another service, and require explicit approval before the agent claims all available coupons.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrases for the coupon-claiming action are broad and can overlap with casual user language, increasing the chance that an agent invokes an account-modifying operation without sufficiently explicit consent. In this skill, the action changes the user's McDonald's account state by binding all available coupons, so ambiguous activation raises the risk of unintended transactions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes one-click coupon claiming but does not prominently warn that it performs an account-modifying action. Without a clear warning and confirmation step, an agent may treat it like a read-only query and execute it automatically, causing unintended changes to the user's account.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal