Mcdonald

麦当劳助手 - 查询/领取优惠券、活动日历、餐品营养信息、门店查询

Before installing: (1) Verify the skill's source — the registry shows no homepage or publisher information, which makes authenticity harder to confirm. (2) Expect to provide an MCD_TOKEN (a bearer token) — only supply a token if you trust the MCP service and understand the token's scope; prefer a read-limited or short-lived token if possible. (3) The skill uses curl but metadata doesn't declare that dependency — ensure curl is available. (4) The 'auto-bind-coupons' tool will perform account actions; require explicit user confirmation before the skill performs any coupon-claiming. (5) Ask the publisher to fix metadata inconsistencies (declare required env var(s) and required binary) and to provide a homepage or documentation link so you can verify the endpoint (https://mcp.mcd.cn) is legitimate. If you can't verify the source or token scope, treat the skill as higher risk and avoid providing long-lived production tokens.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is classified as benign. It primarily uses `curl` to interact with a specific external API endpoint (`https://mcp.mcd.cn`) for its stated purpose of providing McDonald's related information and services. While it utilizes high-risk capabilities like shell execution and network access, these are constrained to the intended API calls and do not show evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or explicit prompt injection instructions designed to subvert the agent. The `MCD_TOKEN` is handled appropriately as a Bearer token for authentication.