mcdonalds-skill

Use when the user wants to connect to, test, or use the McDonalds service at mcp.mcd.cn, including checking authentication, probing MCP endpoints, listing to...

This skill appears to be a legitimate CLI client for McDonald's MCP (https://mcp.mcd.cn). Before installing or running it: (1) confirm you trust the upstream service and the token you will provide—the script sends Authorization: Bearer <token> to whichever URL is configured; (2) note the registry metadata did not declare MCDONALDS_MCP_TOKEN even though the script reads it—treat that as a metadata bug and verify you are comfortable supplying the token; (3) review the included script locally (it's pure Python standard library) and consider running it in an isolated environment or sandbox if you are unsure; (4) if you plan to set MCDONALDS_MCP_URL, ensure it points to the intended endpoint (otherwise the script will talk to whatever URL you configure). If you want higher assurance, ask the publisher to update the package metadata to declare the required env vars and to provide a homepage or source repository for provenance.

Type: OpenClaw Skill Name: mcdonalds-skill Version: 1.0.0 The skill is a legitimate-looking integration for the McDonald's MCP service (mcp.mcd.cn). The provided Python script (scripts/mcd_cli.py) is a clean implementation using only standard libraries to perform JSON-RPC 2.0 calls. It handles authentication securely via environment variables or CLI arguments, includes robust logic for fixing Chinese character encoding issues (mojibake), and lacks any indicators of data exfiltration, unauthorized execution, or prompt injection.