Security audit

麦当劳MCP自动化工具

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real account automation tool, but it under-discloses sensitive token handling and financial/account-impact risks.

Review before installing. Use only an account you are comfortable automating, treat MCD_TOKEN like a password, avoid putting it directly in cron, and do not rely on the advertised one-click ordering capability without inspecting and adding explicit confirmation and price-review safeguards.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:70
Finding: Account Token Stored in Plaintext Cron Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: mcd-cli.sh:26
Finding: Hard-Coded Shared API Signing Secret Using MD5
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: mcd-cli.sh:50
Finding: Authenticated JSON Parameter Injection Through Unsafe String Interpolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description presents consumer-order automation, but the supplied content also implies authenticated external API use with token capture/handling while failing to reflect that in permissions or safety constraints. This mismatch can mislead users and platforms about the real risk boundary, especially when the skill can place real orders and interact with account-linked services.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises shell-based operational behavior via required binaries (curl, jq) but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens containment and reviewability because the skill can drive networked shell actions against authenticated APIs without a clear least-privilege declaration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to capture and export an account token without clear warnings about credential sensitivity, account takeover risk, or secure handling requirements. Because the token appears sufficient to access McDonald's account functions, accidental leakage could enable unauthorized coupon redemption, order placement, or account abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Documenting a one-click order command without an explicit warning that it may submit a real purchase creates a significant risk of unintended financial or account impact. In this skill context, ordering is not hypothetical: it is a direct, real-world transaction against a user's linked account and store selection.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The script transmits an authentication token and user-supplied request data to a remote service over the network, enabling account-linked actions such as coupon claiming and inventory/order-related queries. In this skill context, the danger is elevated because the tool automates authenticated actions against a consumer account, but there is no explicit user consent flow, destination verification beyond the hardcoded host, or safeguards around sensitive token usage.
Content: Scanner excerpt · mcd-cli.sh (reported line 31)May include surrounding context.
sh
local timestamp=$(date +%s) local sign=$(echo -n "${path}${timestamp}${data}2Iyu4Gd9oJRFJl90JJq1JOn58wWecU9i" | openssl md5 -r | awk '{print $1}') curl -s -X $method \ --connect-timeout $DEFAULT_TIMEOUT \ -H "Content-Type: application/json" \ -H "MCD-Token: $MCD_TOKEN" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This shell script performs outbound HTTP requests to a remote API and includes the sensitive MCD_TOKEN credential in request headers. While the script has informational output for some actions, it does not disclose to the user that their token and request data will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Manifest description states the tool supports placing orders, and the CLI help text also advertises order:place. However, the command dispatcher implements only coupon receipt, store stock query, and order calculation; there is no order:place branch or corresponding function. This creates a clear description-to-behavior mismatch about the skill's actual capabilities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: All user-facing description, setup steps, examples, and command context are presented only in Chinese, with no indication that alternative languages are supported or that the locale restriction is intentional and documented. The policy requires flagging language or locale constraints when they are imposed without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: All user-facing comments and command-line messages are in Chinese, and the script does not offer an alternative language or document that it is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.