My Mcdonald

• Analyzed: May 12, 2026, 3:27 AM
• Findings: 1
• Version: 1.0.0
• Hash: c82abe9981a52ffa282b948bd282dc57ef23710f19667fcd53613b9d47f02343
• Source: palm
• External report: View on VirusTotal

Findings (1)

OpenClaw Agent Skill The skill is designed to interact with a McDonald's API (`mcp.mcd.cn`) to query and manage coupons, view activity calendars, and access nutrition information. It requires an `MCD_TOKEN` for authentication, which is sent only to the specified McDonald's domain. All `curl` commands are directed to this legitimate endpoint and perform actions consistent with the stated purpose. There is no evidence of prompt injection, unauthorized data exfiltration, malicious execution, or persistence mechanisms.