麦当劳MCP服务集成，支持点餐、优惠券、麦麦商城、积分兑换等功能。需要用户先在 https://open.mcd.cn 申请MCP Token。

This skill appears to be what it claims: it sends POST requests to https://mcp.mcd.cn using an MCP Token you obtain from the official developer portal. Before installing or using: (1) only provide a token obtained from https://open.mcd.cn and avoid sharing long-lived/high-privilege tokens — prefer a scoped or short-lived token if available; (2) note the small metadata mismatch (ownerId in _meta.json differs from registry owner) — this can be benign but review provenance if you require a high level of trust; (3) the included script prints API responses to stdout — responses might include personal data (addresses, coupons, order details), so run it in a safe environment; (4) if you plan to let an autonomous agent use the skill, be aware it can call the MCP API using any token you supply, so consider limiting the token's permissions or lifetime. If you want extra assurance, inspect or run the provided scripts locally rather than giving the token to an unfamiliar hosted agent.

Type: OpenClaw Skill Name: mcdonalds-mcp-assistant Version: 1.1.0 The skill bundle provides a legitimate integration with the McDonald's MCP (Model Context Protocol) API for services like ordering and coupon management. The script `scripts/mcdonalds-mcp.js` is a straightforward wrapper that sends user-provided tokens to official McDonald's China subdomains (mcd.cn) via standard HTTPS requests. No evidence of data exfiltration, malicious execution, or prompt injection was found.