mcdonald

SUSPICIOUS: The skill’s business purpose and official McDonald’s MCP data flows are largely coherent, but it is a non-official personal integration that falls back to an unverified mcd CLI while handling a live bearer token and enabling real-world purchases/address writes. Main risk is trust in the fallback execution path, not obvious malware or off-domain exfiltration.