麦门点餐议事会

• Outcome: Pass
• Latest audit: Oct 13, 2026 · 6:28 PM UTC
• Version: 0.3.2

Overview

This skill is a disclosed, read-only McDonald’s China meal, coupon, points, and delivery-context helper that uses an official MCP endpoint without ordering, payment, coupon claiming, or persistent storage.

Install only if you are comfortable using a local McDonald’s China MCP token for read-only live menu, coupon, points, and delivery-context checks. Use live mode for current prices, avoid sharing token or raw account/coupon/address data, and treat saved snapshots as demonstrations rather than current offers.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description emphasizes a McDonald’s ordering-discussion tool that compares full menus under budget/taste, preserves sugar and ice preferences, checks coupon expiry/usability, distinguishes coupon packages and store/time applicability, and then uses an official MCP to verify price only. The supplied code only operates on already-provided data structures (data, plans) and performs deterministic validation, filtering, and ranking of meal combinations. While it does support sugar and ice preferences and budget-based meal comparison, it lacks the key declared capabilities around coupons and official price-query integration. There is no logic for coupons, expiry dates, package eligibility, time windows, or store-specific coupon rules. There is also no external MCP/API call; mode is merely a label in input data, and live freshness is checked only via timestamp age. Additionally, select_plan introduces a selection capability (though explicitly not ordering), which is slightly beyond a strict query-only核价 function. Overall, the implemented behavior is materially narrower and different from the declared coupon-aware official-price-checking purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

声明强调的核心能力是餐单比较、优惠券适用性判断以及官方 MCP 核价，且说明先确认门店与到店/配送。该代码片段只覆盖“确认门店/配送”的前置步骤，主要处理门店搜索和配送地址相关数据，还会访问用户已保存的配送地址资源。虽然这些功能可视为整体流程的支持性实现，但就这个代码块本身而言，其实际行为与声明的主目的明显不一致：没有任何餐单、预算、口味、券包、时段适用性或价格计算逻辑。尤其是读取配送地址列表属于声明中未明确提到的资源访问能力，因此应判定为描述与代码行为存在不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

只清点券时不查询积分或订单。使用 `query-my-coupons`，每页最多 200 条，最多 5 页；核对页码、总数与分页期间的一致性。不完整时明确标记，不能当作全部券。可运行 `python3 scripts/demo.py --my-coupons` 复用确定性分析；`--json` 提供全部脱敏明细。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares strong operational boundaries in prose, but it does not define explicit tool permissions or an allowed-tools scope despite referencing capabilities that involve environment access, file operations, and networked queries. In an agent setting, missing scope controls can let the runtime grant broader access than intended, increasing the chance of unauthorized data exposure or tool misuse if the skill is invoked or modified unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document title and all operational guidance are written entirely in Chinese, indicating a language-specific skill behavior. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly documented and justified, which is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The store name, address fields, source description, and scope text are all encoded in Chinese with no indication that the skill supports user language selection or that the file is intentionally limited to a China-specific workflow. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains user-facing exception messages in Chinese only, such as the ValueError strings on L10, L14, and L19. Because the file provides no indication that the skill is China-specific or that users can choose locale, this creates a natural-language policy concern by forcing a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's user-facing error and notice strings are written exclusively in Chinese, and this pattern continues throughout the skill. That creates a language/locale constraint without any visible user opt-in or justification that the skill is intentionally region-specific, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill manifest says it should only use official MCP price checks and should not rely on non-live data, but the code explicitly accepts "snapshot" and "synthetic" modes. In a pricing and coupon-selection context, this can mislead users into acting on stale or fabricated prices, especially because the same review flow processes all modes and only communicates the distinction via notices rather than enforcing live-only behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This Python file contains multiple hard-coded user-facing exception messages in Chinese, such as at L10, L13, and throughout the function. For code files, natural-language policy violations include forcing a specific language or locale without offering a user choice, and there is no indication here of opt-in or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file raises multiple user-facing errors and returns descriptive text exclusively in Chinese, such as at L019, L025, and throughout the module. For an all-file language policy review, this is a natural-language locale constraint that is not documented as region-specific or presented as a user-selectable option.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The declared skill scope is read-only pricing and menu comparison, but the allowed tool list also includes account and coupon endpoints such as query-my-account, query-my-coupons, and available-coupons. This expands the accessible data surface to user-specific information without clear need, violating least privilege and creating unnecessary privacy exposure if the agent is prompted to access or summarize personal account data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code permits access to personal account and delivery-address related tools despite the stated purpose being gourmet menu comparison and coupon applicability checking via official pricing queries. Address and account data are sensitive personal information, and exposing these capabilities increases the chance of unnecessary collection, disclosure, or misuse through prompt-driven tool invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.