麦当劳MCP自动化工具

麦当劳MCP接口自动化工具，支持自动领券、查询门店库存、计算最优优惠组合、一键下单，解决麦当劳优惠券手动领取麻烦、库存查询不便的问题。

Do not run this script blindly. Before installing: (1) confirm the repository/source (homepage shows placeholders); prefer an official upstream. (2) Inspect the mcd-cli.sh locally — it requires MCD_TOKEN and shells out to openssl and bc (ensure these are installed and declared). (3) Do not paste long-lived tokens into publicly visible cron jobs or logs; use a secure secret store and rotate tokens frequently. (4) Be cautious about the SKILL.md suggestion to '抓包获取' (packet capture) — intercepting app traffic can expose other credentials and may violate terms. (5) Note the script embeds a signing secret — ask the author why a client secret is hard-coded. (6) If you still want to use it, run it in an isolated account/container, verify it only talks to the expected domain (https://mcp.mcd.cn), and avoid granting broader credentials. If any of these concerns are unacceptable or unexplained by the author, do not install.

Type: OpenClaw Skill Name: mcd-mcp Version: 1.1.0 The skill bundle contains a critical shell injection vulnerability in `mcd-cli.sh` because user-provided inputs (such as city names or keywords) are passed unsanitized into a `curl` command, potentially allowing arbitrary command execution. Furthermore, there is a major discrepancy between the `SKILL.md` instructions, which claim the API uses JSON-RPC 2.0 and a `tools/call` method, and the actual `mcd-cli.sh` script, which uses REST-like endpoints (e.g., `/v1/coupon/receive`). While the script targets a legitimate domain (mcp.mcd.cn) and uses a known signature salt, the combination of RCE risk and contradictory instructions makes the bundle unsafe for use.