Skill: lililisir/mcdonald-order (version 1.0.5)

--- name: mcdonald-order description: McDonald's China assistant (麦当劳助手) for coupon management, delivery ordering, and nutrition planning. Use this skill when users explicitly mention McDonald's (麦当劳) and want to check/claim coupons (优惠券、领券), order delivery (麦乐送、外卖、点餐), query menu items and prices (菜单、价格), check nutrition info or plan meals within calorie limits (热量、卡路里、营养、搭配套餐), view promotions (活动、优惠、新品), or track order status (订单、配送). Also trigger for McDonald's nutrition queries in comparison contexts with other fast food brands. --- # McDonald's Assistant (麦当劳助手) ## Prerequisites **Required Tools**: `execute_bash` **Required Environment Variables**: - `MCD_TOKEN` (required) - API authentication token from https://mcp.mcd.cn - `MCD_MCP_URL` (optional) - MCP service endpoint URL (default: https://mcp.mcd.cn) **Security Notes**: - MCD_TOKEN contains API credentials - never log or expose in output - Always require user confirmation before creating orders or claiming coupons - Price calculations must be confirmed by user before order creation Help users interact with McDonald's China services through MCP API calls. This skill handles the complete customer journey from browsing coupons to placing delivery orders. ## Core Capabilities 1. **Coupon Management** - Browse available coupons, auto-claim all coupons, view owned coupons 2. **Campaign Calendar** - Check ongoing and upcoming promotional activities 3. **Nutrition Information** - Query calorie and nutrition data for menu items, help users build meals within calorie targets 4. **Delivery Ordering** - Complete order flow: address management → menu browsing → price calculation → order creation 5. **Order Tracking** - Check order status and delivery progress ## Prerequisites **Required**: `MCD_TOKEN` environment variable must be set. Users obtain this from https://mcp.mcd.cn If the token is missing or API returns authentication errors: 1. Inform the user they need to set `MCD_TOKEN` 2. Provide the registration URL: https://mcp.mcd.cn 3. Show how to set it: `export MCD_TOKEN="your_token_here"` ## API Call Pattern All tools are invoked via curl to the MCP endpoint: ```bash curl -s -X POST "${MCD_MCP_URL:-https://mcp.mcd.cn}" \ -H "Authorization: Bearer ${MCD_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}},"id":1}' ``` Parse responses from `result.content[0].text` or `result.structuredContent`. **Error handling**: If you receive authentication errors, guide the user to check their token. For rate limiting, suggest waiting before retrying. ## Workflow Patterns ### Pattern 1: Coupon Discovery & Claiming **Trigger phrases**: "有什么优惠券", "帮我领券", "麦当劳优惠" **Flow**: 1. Call `available-coupons` to show what's claimable 2. If user wants to claim, call `auto-bind-coupons` 3. Optionally call `query-my-coupons` to confirm **Output format**: Present as a numbered list with: - Coupon name and discount amount - Validity period - Usage conditions (if any) ### Pattern 2: Delivery Order (Critical Path) **Trigger phrases**: "我要点外卖", "麦乐送", "点麦当劳" **Flow** (must follow this sequence): 1. **Get delivery address** - Call `delivery-query-addresses` - Returns: `addressId`, `storeCode`, `beCode` (required for all subsequent calls) - If empty: Guide user to create address with `delivery-create-address` - If multiple: Ask user to choose 2. **Browse menu** - Call `query-meals` with `storeCode` and `beCode` - Show menu items with names, prices, and `productCode` - User selects items 3. **Check store coupons** (optional) - Call `query-store-coupons` - Show coupons valid at this store - Display applicable products for each coupon 4. **Calculate price** - Call `calculate-price` with selected items - **Critical**: All prices are in cents (分), divide by 100 for display - Show: original price, discounts, delivery fee, packing fee, final total - Wait for user confirmation before proceeding 5. **Create order** - Call `create-order` only after user confirms price - Returns payment link and order ID - Guide user to complete payment - Suggest they can check status later with `query-order` **Why this sequence matters**: Each step depends on data from the previous step. The `storeCode` and `beCode` from step 1 are required for steps 2-5. Skipping address lookup will cause all subsequent calls to fail. ### Pattern 3: Nutrition Query & Meal Planning **Trigger phrases**: "热量", "卡路里", "营养成分", "帮我搭配XX卡套餐" **Flow**: 1. Call `list-nutrition-foods` to get nutrition database 2. If user wants a specific calorie target, calculate combinations that fit 3. Present options with complete nutrition breakdown **Output format** (required): Always show nutrition data in a table format: | 食品 | 热量(kcal) | 蛋白质(g) | 脂肪(g) | 碳水(g) | |------|-----------|----------|---------|---------| | 巨无霸 | 563 | 26 | 33 | 45 | | 中薯条 | 340 | 4 | 16 | 44 | | 可乐(中) | 150 | 0 | 0 | 39 | | **总计** | **1053** | **30** | **49** | **128** | **Why this matters**: Users asking about nutrition need complete macronutrient data, not just calories. The `list-nutrition-foods` tool provides protein, fat, and carbs - always display all of these when doing meal planning. This helps users make informed dietary decisions. ### Pattern 4: Order Tracking **Trigger phrases**: "查订单", "配送到哪了", "订单状态" **Flow**: 1. Ask for 34-digit order ID if not provided 2. Call `query-order` with the order ID 3. Show order status, items, delivery progress ## Tool Reference ### available-coupons **Purpose**: List all currently claimable coupons **Parameters**: None **When**: User asks what coupons are available ### auto-bind-coupons **Purpose**: Claim all available coupons to user's account **Parameters**: None **When**: User says "帮我领券", "一键领取" ### query-my-coupons **Purpose**: Show coupons user has already claimed **Parameters**: `page` (default "1"), `pageSize` (default "50") **When**: User asks "我有哪些券" ### campaign-calendar **Purpose**: Show recent and upcoming promotional campaigns **Parameters**: `specifiedDate` (optional, format: yyyy-MM-dd) **When**: User asks about promotions or activities ### list-nutrition-foods **Purpose**: Get nutrition data for common menu items **Parameters**: None **Returns**: Nutrition database with calories, protein, fat, carbs, sodium, calcium for each item **When**: User asks about calories, nutrition, or wants meal planning help **Output requirement**: Always present data in table format showing all available nutrition fields, not just calories ### delivery-query-addresses **Purpose**: Get user's saved delivery addresses and matching store info **Parameters**: None **Returns**: `addressId`, `storeCode`, `beCode` (save these for subsequent calls) **When**: Starting any delivery order flow **Critical**: This must be the first call in the delivery workflow ### delivery-create-address **Purpose**: Add a new delivery address **Parameters** (all required): - `city`: City name (e.g., "南京市") - `contactName`: Contact person name - `gender`: "先生" or "女士" - `phone`: 11-digit mobile number starting with 1 - `address`: Street address - `addressDetail`: Unit/room number **When**: User has no addresses or wants to add a new one **Validation**: Never use placeholder values. Ask user for real information if missing. ### query-store-coupons **Purpose**: Show coupons valid at a specific store and their applicable products **Parameters**: `storeCode`, `beCode` (from `delivery-query-addresses`) **When**: User wants to see what coupons they can use for current order **Prerequisite**: Must call `delivery-query-addresses` first ### query-meals **Purpose**: Get menu items available at a store **Parameters**: `storeCode`, `beCode` (from `delivery-query-addresses`) **Returns**: Product list with `productCode` needed for ordering **When**: User wants to browse menu **Prerequisite**: Must call `delivery-query-addresses` first ### query-meal-detail **Purpose**: Get detailed info about a specific menu item **Parameters**: `storeCode`, `beCode`, `code` (product code from `query-meals`) **When**: User asks for details about a specific item ### calculate-price **Purpose**: Calculate order total including discounts, delivery, and packing fees **Parameters**: - `storeCode`, `beCode` (from `delivery-query-addresses`) - `items`: Array of `{productCode, quantity, couponId?, couponCode?}` **Returns**: Prices in cents (分) - divide by 100 for display **When**: After user selects items, before creating order **Critical**: Always call this and get user confirmation before `create-order` ### create-order **Purpose**: Place a delivery order **Parameters**: - `addressId` (from `delivery-query-addresses`) - `storeCode`, `beCode` (from `delivery-query-addresses`) - `items`: Array of `{productCode, quantity, couponId?, couponCode?}` **Returns**: Payment link and order ID **When**: After user confirms price from `calculate-price` **Prerequisites**: 1. Must call `delivery-query-addresses` first 2. Must call `calculate-price` and get user confirmation ### query-order **Purpose**: Check order status and delivery progress **Parameters**: `orderId` (34-digit order tracking number) **When**: User wants to track their order ### now-time-info **Purpose**: Get current server time for checking campaign validity **Parameters**: None **When**: Needed to determine if promotions are active (usually automatic) ## Communication Guidelines - Use friendly, conversational Chinese - When showing prices, always convert from cents to yuan (divide by 100) - For delivery orders, explain each step briefly so users understand the flow - If an API call fails, explain the error in plain language and suggest next steps - When order is created, remind users to complete payment and offer to help track the order later ## Common Pitfalls 1. **Skipping address lookup**: Never try to query menu or create orders without first calling `delivery-query-addresses` 2. **Price unit confusion**: API returns cents (分), always divide by 100 before showing to users 3. **Missing price confirmation**: Always call `calculate-price` and wait for user OK before `create-order` 4. **Using placeholder data**: For `delivery-create-address`, never use fake phone numbers or addresses - ask the user for real information 5. **Wrong parameter source**: `storeCode` and `beCode` must come from the same store record in `delivery-query-addresses` response ## Example Interactions **Example 1: Quick coupon claim** ``` User: 今天有什么优惠券？ Assistant: [calls available-coupons] Assistant: 当前可领取3张优惠券： 1. 麦辣鸡腿堡套餐立减5元（有效期至3月10日） 2. 任意饮品第二杯半价（有效期至3月15日） 3. 满30减5元（有效期至3月20日） 需要帮你一键领取吗？ User: 好的 Assistant: [calls auto-bind-coupons] Assistant: ✅ 已成功领取3张优惠券到您的账户！ ``` **Example 2: Delivery order with coupon** ``` User: 我想点麦乐送 Assistant: [calls delivery-query-addresses] Assistant: 您有以下配送地址： 1. 📍 清竹园9号楼 2单元508（李明 先生） 请选择配送地址，或告诉我新地址信息。 User: 就第一个 Assistant: [calls query-store-coupons, query-meals in parallel] Assistant: 好的！这个门店您有2张可用优惠券： - 麦辣鸡腿堡套餐立减5元 - 满30减5元 菜单包括：[shows menu categories] 您想点什么？ User: 一个巨无霸套餐，用满减券 Assistant: [calls calculate-price with coupon] Assistant: 价格明细： - 商品原价：35.00元 - 优惠：-5.00元 - 运费：6.00元 - 打包费：2.00元 - 应付总额：38.00元 确认下单吗？ User: 确认 Assistant: [calls create-order] Assistant: ✅ 订单创建成功！订单号：1030938730000733964700499858 请通过支付链接完成支付：[link] 支付完成后可以随时问我"查订单"来查看配送进度。 ```

path: README.md
content: # McDonald's Order Skill (麦当劳点餐助手)

## ⚠️ SECURITY WARNING

**This skill requires sensitive permissions:**
- 🔑 **API Token** (MCD_TOKEN) - Access to your McDonald's account
- 💻 **Shell Access** (execute_bash) - Can run system commands

**Before installation:**
1. ✅ Review the source code in SKILL.md
2. ✅ Read [SECURITY.md](SECURITY.md) for detailed security considerations
3. ✅ Only install from trusted sources (official Anthropic repository)
4. ✅ Verify all curl commands only target `mcp.mcd.cn`

**Risk**: If this skill is from an untrusted source, it could potentially exfiltrate your API token or execute malicious commands.

**Recommendation**: Only proceed if you trust the skill origin and have reviewed the code.

---

## 📦 技能信息

- **名称**: mcdonald-order
- **版本**: 2.0.0
- **作者**: Kiro Skill Creator
- **分类**: 生活服务 / 美食外卖
- **标签**: 麦当劳、优惠券、外卖、营养查询

## 🎯 功能特性

### 核心功能
1. **优惠券管理** - 查询、领取、查看已有优惠券
2. **外卖点餐** - 完整的下单流程（地址→菜单→价格→下单）
3. **营养查询** - 160+餐品的详细营养数据，支持热量控制套餐搭配
4. **活动日历** - 查看麦当劳促销活动
5. **订单追踪** - 查询订单状态和配送进度

### 技能亮点
- ✅ **实战验证**: 已通过真实API测试，成功完成领券、点餐、查询等操作
- ✅ **营养专业**: 提供完整营养成分表（热量、蛋白质、脂肪、碳水），支持减肥套餐推荐
- ✅ **流程完整**: 严格遵循下单流程，避免常见错误（如跳过地址查询）
- ✅ **价格准确**: 自动转换价格单位（分→元），显示完整费用明细
- ✅ **优惠智能**: 自动匹配门店可用优惠券

## 📊 评估结果

### 测试通过率
- **使用技能**: 93.3% (14/15)
- **不使用技能**: 26.7% (4/15)
- **提升幅度**: +66.6%

### 测试场景
1. ✅ 优惠券领取流程 - 100% 通过
2. ✅ 外卖下单流程 - 100% 通过
3. ✅ 营养搭配查询 - 80% 通过（已优化）

## 🚀 安装使用

### ⚠️ 安全须知

**重要**: 此技能需要访问您的麦当劳账户，请注意：

1. **凭证保护**
   - `MCD_TOKEN` 是您的 API 凭证，请妥善保管
   - 不要在公共场合分享或展示 Token
   - 定期更换 Token 以提高安全性

2. **操作确认**
   - 技能会在以下操作前**要求您确认**：
     - ✅ 领取优惠券
     - ✅ 创建订单
     - ✅ 使用优惠券
   - 价格计算后必须等待您确认才会下单

3. **自主使用限制**
   - 不建议在无人监督的自动化场景中使用
   - 建议每次使用时人工审核关键操作

### 前置要求
1. 访问 https://mcp.mcd.cn 注册并获取 API Token
2. 设置环境变量：
   ```bash
   # 必需：API 认证 Token
   export MCD_TOKEN="your_token_here"
   
   # 可选：自定义 MCP 服务地址（默认：https://mcp.mcd.cn）
   export MCD_MCP_URL="https://mcp.mcd.cn"
   ```

### 安装方法
```bash
# 解压技能包
tar -xzf mcdonald-order-skill.tar.gz -C ~/.kiro/skills/

# 或直接从仓库安装
kiro-cli skill install mcdonald-order
```

### 使用示例

**查询优惠券**
```
用户: 今天麦当劳有什么优惠券？
助手: [自动调用 available-coupons 查询并展示]
```

**点外卖**
```
用户: 我想点麦乐送
助手: [引导完成：地址选择 → 菜单浏览 → 价格计算 → 确认下单]
```

**营养查询**
```
用户: 我在减肥，想吃点低热量的
助手: [展示营养数据表格，推荐低热量套餐组合]
```

## 📝 技能结构

```
mcdonald-order/
├── SKILL.md           # 主技能文件（包含完整工作流和工具说明）
└── evals/
    └── evals.json     # 测试用例（3个核心场景）
```

## 🔧 技术细节

### 安全机制

**用户确认流程**：
```
1. 查询操作（只读）→ 无需确认
   - available-coupons
   - query-my-coupons
   - query-meals
   - list-nutrition-foods
   - query-order

2. 写入操作（修改数据）→ 必须确认
   - auto-bind-coupons → 询问 "需要帮你一键领取吗？"
   - calculate-price → 显示价格，询问 "确认下单吗？"
   - create-order → 仅在用户明确确认后执行
```

**Token 保护**：
- Token 仅用于 Authorization header
- 不会在输出中显示或记录
- 错误信息不包含 Token 内容

### API 调用方式
通过 MCP (Model Context Protocol) 调用麦当劳中国服务：
```bash
curl -s -X POST "https://mcp.mcd.cn" \
  -H "Authorization: Bearer ${MCD_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}},"id":1}'
```

### 关键工作流

**外卖下单流程**（必须按顺序）：
1. `delivery-query-addresses` - 获取地址和门店信息
2. `query-meals` - 查询菜单
3. `calculate-price` - 计算价格（等待用户确认）
4. `create-order` - 创建订单

**常见陷阱**：
- ❌ 跳过地址查询直接查菜单
- ❌ 价格单位混淆（API返回分，需转换为元）
- ❌ 未等用户确认就下单

## 📈 优化历程

### Iteration 1 → 2 改进
1. **营养信息增强** - 添加完整营养成分表格示例
2. **描述优化** - 更"pushy"的触发描述，提高准确率
3. **工作流明确** - 强调步骤依赖关系和"为什么"
4. **实战验证** - 通过真实API测试验证所有功能

## 🎓 学习价值

这个技能展示了：
- ✅ 如何设计多步骤工作流
- ✅ 如何处理API依赖关系
- ✅ 如何格式化和展示结构化数据
- ✅ 如何通过评估迭代改进技能

## 📄 许可证

MIT License

## 🤝 贡献

欢迎提交 Issue 和 Pull Request！

## 📞 支持

- 技能问题: 提交 GitHub Issue
- MCP [REDACTED_SECRET]
- 麦当劳客服: 400-851-7517

---

**注意**: 此技能仅用于学习和个人使用，请遵守麦当劳服务条款。


path: SECURITY.md
content: # Security Considerations

## ⚠️ Important Security Notice

This skill requires sensitive credentials and system access. Please review these security considerations before installation.

## Required Permissions

### 1. execute_bash Tool
**What it does**: Executes shell commands to make API calls via curl

**Why needed**: The skill uses curl to communicate with McDonald's MCP API

**Potential risks**:
- Can execute arbitrary bash commands
- Could be exploited if skill code is malicious
- Could leak credentials if compromised

**Mitigation**:
- Review SKILL.md source code before installation
- Only install from trusted sources
- Monitor skill behavior during use

### 2. MCD_TOKEN Environment Variable
**What it is**: Your personal McDonald's API authentication token

**Why needed**: Required to access your McDonald's account via API

**Potential risks**:
- If leaked, someone could access your McDonald's account
- Could be used to place orders or claim coupons without your permission
- May expose personal information (addresses, order history)

**Mitigation**:
- Never share your token publicly
- Rotate token regularly at https://mcp.mcd.cn
- Review skill code to ensure token is only used for legitimate API calls

## Code Transparency

### What the skill does with execute_bash:
```bash
# ONLY executes curl commands in this format:
curl -s -X POST "${MCD_MCP_URL:-https://mcp.mcd.cn}" \
  -H "Authorization: Bearer ${MCD_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{...},"id":1}'
```

### What the skill does NOT do:
- ❌ Does not send your token to any other domains
- ❌ Does not execute file system operations (rm, mv, etc.)
- ❌ Does not read or modify files outside the skill directory
- ❌ Does not install additional software
- ❌ Does not open network connections to untrusted servers

## Verification Steps

Before trusting this skill:

1. **Review the source code**
   ```bash
   cat ~/.kiro/skills/mcdonald-order/SKILL.md
   ```
   - Check all curl commands only target `mcp.mcd.cn`
   - Verify no suspicious bash commands
   - Confirm token is only used in Authorization headers

2. **Check the skill origin**
   - Official repository: https://github.com/anthropics/skills
   - Verify package integrity (checksums if available)
   - Check author reputation

3. **Test in isolated environment first**
   - Use a test token if possible
   - Monitor network traffic
   - Review all operations before confirming

## Trust Model

### When to trust this skill:
- ✅ Downloaded from official Anthropic skills repository
- ✅ Source code reviewed and understood
- ✅ No modifications to SKILL.md after download
- ✅ Using official MCD_TOKEN from mcp.mcd.cn

### When NOT to trust:
- ❌ Downloaded from unknown sources
- ❌ Source code contains obfuscated commands
- ❌ Requests tokens for services other than mcp.mcd.cn
- ❌ Modified by untrusted third parties

## Data Exfiltration Prevention

### How this skill protects your data:

1. **Hardcoded API endpoint**
   - Only communicates with `mcp.mcd.cn`
   - MCD_MCP_URL has a safe default
   - No dynamic URL construction from user input

2. **Token scope limitation**
   - Token only works with McDonald's MCP API
   - Cannot be used for other services
   - Limited to McDonald's account operations

3. **No data persistence**
   - Skill does not save tokens to disk
   - No logging of sensitive information
   - Temporary execution only

4. **User confirmation required**
   - All write operations require explicit user approval
   - Read-only queries can proceed without confirmation
   - Clear indication of what each operation does

## Reporting Security Issues

If you discover a security vulnerability:

1. **Do NOT** open a public GitHub issue
2. Contact the skill author privately
3. Provide details of the vulnerability
4. Allow time for a fix before public disclosure

## Alternative: Sandboxed Execution

For maximum security, consider:

1. **Use a dedicated API token**
   - Create a separate token just for this skill
   - Revoke it when not in use

2. **Run in a container**
   ```bash
   docker run --rm -it \
     -e MCD_TOKEN="your_token" \
     kiro-cli-image
   ```

3. **Monitor network traffic**
   ```bash
   # Use tcpdump or wireshark to verify connections
   sudo tcpdump -i any host mcp.mcd.cn
   ```

## Conclusion

This skill requires elevated permissions by design. The security risks are inherent to its functionality (making authenticated API calls). Only install if you:

- ✅ Trust the skill source
- ✅ Have reviewed the code
- ✅ Understand the risks
- ✅ Accept the security trade-offs

**When in doubt, do not install.**


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)