mcd-cn

麦当劳助手 - 查询/领取优惠券、活动日历、餐品营养信息、门店查询

This skill appears to do what it says (call McDonald's MCP API) but has two issues you should consider before installing: (1) SKILL.md requires you to provide an MCD_TOKEN for your account, yet the registry metadata did not declare any required env vars — confirm with the publisher why the registry omits this. (2) The 'auto-bind-coupons' tool is state-changing and will perform actions in your account if the skill is allowed to run; do not enable autonomous execution of state-changing commands without explicit user consent. Additional recommendations: only provide the minimum-scoped token the service supports (avoid sharing full-account credentials), verify the MCP endpoint (https://mcp.mcd.cn) is legitimate, avoid pasting the token into public chats, consider requiring manual confirmation for coupon-claiming operations, and be mindful of rate limits and privacy implications.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill is classified as benign. It uses `curl` commands to interact with a McDonald's MCP service (`mcp.mcd.cn`) for its stated purpose of querying coupons, activities, and nutrition information. It requires an `MCD_TOKEN` for authentication, which is handled via an environment variable, and explicitly warns against exposing it. While it performs network requests and uses a sensitive token, these actions are clearly aligned with the skill's functionality and there is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence, or prompt injection attempts against the agent in SKILL.md.