The Agent Skills Directory

[DATA_EXPOSURE_EXFILTRATION]: The skill demonstrates safe security practices by using environment variables for sensitive tokens (MCD_MCP_TOKEN). It includes documentation and automated scripts to ensure that personal data like order IDs and coupon codes are stripped from data snapshots before being saved or submitted to the repository.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from official McDonald's MCP tools (e.g., query-meals, available-coupons). While this data enters the agent context via scripts/adviser.py, the risk is low as the source is a trusted service and the data is processed through a structured engine with strict validation rules defined in SKILL.md. No evidence of unsafe interpolation of untrusted strings into prompts was found.
[COMMAND_EXECUTION]: Static analysis flagged a subprocess.run call in tests/test_adviser.py. Investigation shows this is a benign testing utility (run_cli) used to verify the functionality of the local adviser.py script during the development and CI process. It does not execute arbitrary or user-supplied commands.
[OBFUSCATION]: No malicious obfuscation was detected. Standard usage of data URIs for favicons in HTML files and verification hashes for service validation were identified as benign.
[CREDENTIALS_UNSAFE]: No hardcoded secrets were found. All references to API tokens use placeholders or environment variable references, and the project includes guides on how to manage these credentials safely.

mcd-meal-adviser