My Mcdonald

麦当劳助手 - 查询/领取优惠券、活动日历、餐品营养信息、门店查询

What to consider before installing: - Source unknown: The skill has no homepage and an unknown owner — treat it as unvetted. Verify the MCP endpoint (https://mcp.mcd.cn) is legitimate before providing any token. - Token required but not declared in metadata: SKILL.md expects MCD_TOKEN (and optional MCD_MCP_URL), yet the registry metadata listed no required env vars. That mismatch is suspicious; assume the skill will need your MCD_TOKEN to operate. - Sensitive capability: With your MCD_TOKEN the skill can perform state-changing actions (auto-bind-coupons) against your account. Only grant a token you control, and prefer a limited-scope or revocable token if possible. - Operational safety: Configure the agent to ask for explicit user confirmation before running the "auto-bind-coupons" or any action that modifies your account. Consider allowing read-only calls (list coupons, nutrition) first and test behavior. - Token handling: Never paste tokens into public chats. Store MCD_TOKEN in a secure place and rotate/revoke it if you stop using the skill or see unexpected activity. - Rate limits & privacy: The skill warns about rate limits; avoid automated high-frequency polling. Review what personal data the MCP API returns and whether you are comfortable sharing it with the agent. If you need higher assurance, ask the skill author for a homepage/source repo, a declared list of required env vars in the registry metadata, and documentation of token scopes and safety controls.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill is designed to interact with a McDonald's API (`mcp.mcd.cn`) to query and manage coupons, view activity calendars, and access nutrition information. It requires an `MCD_TOKEN` for authentication, which is sent only to the specified McDonald's domain. All `curl` commands are directed to this legitimate endpoint and perform actions consistent with the stated purpose. There is no evidence of prompt injection, unauthorized data exfiltration, malicious execution, or persistence mechanisms.