Cookidoo

Manage Thermomix/Cookidoo meal planning via tmx-cli. Use for recipe search, weekly meal plan management, shopping list generation, favorites, and recipe details. Trigger when the user mentions Cookidoo, Thermomix, Wochenplan, meal plan, Rezept, recipe, or Einkaufsliste for cooking.

Security Scan

The skill mostly does what it says (a Cookidoo CLI) but its documentation/code disagree about how credentials are handled and it writes session/credential files to disk without declaring required secrets — this mismatch is worth caution.

Purpose & Capability

Name, description, README, SKILL.md and the bundled Python CLI are consistent: the code implements searching, plan/shopping management, favorites, and uses Cookidoo/Algolia endpoints. There are no unrelated cloud services or surprising binaries required.

Instruction Scope

SKILL.md instructs the agent to run the bundled tmx_cli.py and to log in (OAuth or credentials). The implementation reads/writes local files (cookies, search token, category cache, config) and performs network calls to cookidoo.de and Algolia — expected for this purpose — but some documentation (references/commands.md) explicitly mentions storing credentials in secrets/cookidoo.env (COOKIDOO_EMAIL, COOKIDOO_PASSWORD) even though the skill metadata declares no required env vars. The instructions give the agent discretion to run login flows and persist session tokens, which increases the sensitivity of what the skill will access.

Install Mechanism

This is an instruction-only skill bundled with the tmx_cli.py source; there is no install script that downloads arbitrary code. README shows optional GitHub installs (uvx/pipx) but the registry package contains the Python file itself. No high-risk download-from-URL installs are present in the bundle.

Credentials

Skill metadata declares no required environment variables, yet docs/code indicate the CLI can accept/store Cookidoo credentials and session tokens (cookies, cookidoo_search_token.json) and the commands reference storing COOKIDOO_EMAIL/COOKIDOO_PASSWORD in secrets/cookidoo.env. The skill writes to ~/.tmx_config.json and to files under the script directory. Requesting/saving user credentials and session cookies is proportionate to login-based functionality, but the omission of any declared secret requirements in the metadata and the presence of multiple storage locations is an inconsistency that should be clarified before use.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It will persist session and config files (in the skill directory and in the user's home directory), which is expected for a CLI that maintains login state, but users should be aware these files contain credentials/tokens and live on disk.

What to consider before installing

This skill appears to implement a legitimate Cookidoo CLI, but there are inconsistencies you should resolve before installing: 1) The registry metadata declares no required secrets, yet the docs and code accept and store Cookidoo credentials and session cookies (files under the skill directory and ~/.tmx_config.json). Confirm whether the skill will ask for your raw password or use an OAuth browser flow, and prefer OAuth if available. 2) If you provide credentials, expect them (or session tokens) to be written to disk; treat those files as sensitive. 3) If you plan to install from the GitHub repo referenced in the README, review that repository (commit history, issues, maintainer) to ensure you trust the source. 4) If you want to limit risk, run the tool in an isolated environment (container or dedicated account) or avoid supplying your Cookidoo password and use OAuth-only login. Finally, ask the maintainer to update the skill metadata to declare any required env vars or credential storage paths so the security posture is clear.

Cookidoo / tmx-cli Skill

Manage Cookidoo® (Thermomix) meal plans, recipes, and shopping lists using tmx-cli — a pure-Python CLI bundled in this skill at {baseDir}/tmx_cli.py.

Setup

1. Python 3.9+ required (no external dependencies)
2. Login: python3 {baseDir}/tmx_cli.py login (OAuth flow with Cookidoo account)
3. Setup (optional): python3 {baseDir}/tmx_cli.py setup — configure TM version, diet preferences, max cooking time

Critical Rules

1. Confirm before destructive actions (shopping clear, plan remove).
2. Use --json when parsing output programmatically.
3. Respect user preferences — setup config auto-applies to searches.

CLI Usage

python3 {baseDir}/../tmx-cli/tmx_cli.py <resource> <action> [options]

Core Workflows

Search Recipes

tmx search "Pasta" --json
tmx search "Kuchen" -n 20 --json              # more results
tmx search "Suppe" -t 30 --json               # max 30 min prep time
tmx search "Salat" -d easy -c vegetarisch --json  # easy + vegetarian

Filters: -t <minutes>, -d easy|medium|advanced, --tm TM5|TM6|TM7, -c <category>

Categories: vorspeisen, suppen, pasta, fleisch, fisch, vegetarisch, beilagen, desserts, herzhaft-backen, kuchen, brot, getraenke, grundrezepte, saucen, snacks

Recipe Details

tmx recipe show <recipe_id> --json   # ingredients, steps, nutrition

Meal Plan

tmx plan show --json                 # current week plan
tmx plan sync                        # sync from Cookidoo
tmx plan add <recipe_id> <day>       # add recipe (day: mon/tue/wed/thu/fri/sat/sun)
tmx plan remove <recipe_id> <day>    # remove from plan
tmx plan move <recipe_id> <from> <to>  # move between days

Shopping List

tmx shopping show --json             # current list
tmx shopping from-plan               # generate from meal plan
tmx shopping add <recipe_id>         # add recipe ingredients
tmx shopping add-item "Milch" "1L"   # add custom item
tmx shopping remove <recipe_id>      # remove recipe ingredients
tmx shopping clear                   # clear entire list ⚠️
tmx shopping export                  # export as markdown
tmx shopping export --format json    # export as JSON

Today's Recipes

tmx today --json                     # what's on the plan today

Favorites

tmx favorites show --json
tmx favorites add <recipe_id>
tmx favorites remove <recipe_id>

Full Command Reference

For all commands, options, and flags see {baseDir}/references/commands.md.