The Agent Skills Directory

[SAFE]: The skill is a standard integration with the official McDonald's China MCP service endpoint (https://mcp.mcd.cn). All network communication is restricted to this official domain.
[SAFE]: Authentication is handled securely using the MCD_MCP_TOKEN environment variable. The skill documentation explicitly instructs users to avoid pasting tokens into prompts or files and provides safe methods for injecting the token into the process environment.
[SAFE]: The skill implements a robust confirmation system for sensitive actions. Tools that change state (e.g., create-order, mall-create-order, delivery-create-address, auto-bind-coupons) require the agent to restate all details to the user and obtain explicit permission before proceeding with the --confirm-write flag.
[SAFE]: The bundled CLI tool (scripts/mcd) uses standard Python libraries to communicate with the service. It does not contain any obfuscated code, persistence mechanisms, or unauthorized data exfiltration patterns.
[SAFE]: The test suite (tests/test_mcd.py) uses standard unit testing patterns, including loading the local CLI script via importlib and verifying behavior with subprocess.run, all of which are confined to the local development and testing environment.

mcdonald