calorie1-detective-v3

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:15 AM UTC
• Version: 3.0.2

Overview

This skill is a coherent food-photo calorie calculator that uses a disclosed vision API path, with privacy and packaging caveats users should understand before uploading photos.

Install only if you are comfortable sending chosen food images to the Moonshot/Kimi API. Avoid uploading photos that include faces, documents, location clues, or other private context. Use the manual description mode for sensitive meals, and prefer pinned dependencies or a trusted environment for installation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises capabilities consistent with environment access, file reading, and network use, but does not declare any explicit tool scope or permissions. This weakens least-privilege controls and user transparency, making it easier for a skill with external API usage to access more resources than expected if the host platform infers or grants broad defaults.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that food photos are processed through the Kimi vision API but does not clearly warn users that uploaded images will be sent to an external service. Images can contain sensitive information such as faces, location clues, medical or dietary details, and metadata, so failing to disclose external transmission undermines informed consent and privacy expectations.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The configuration sets `output.language: zh`, which enforces a specific language by default. Under the language/locale policy, this is a natural-language policy concern unless the skill offers user choice or clearly documents a justified region-specific constraint.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code base64-encodes the entire user-supplied image and transmits it to Moonshot's external vision API, but the file contains no explicit consent flow, warning, or opt-in informing users that their photo contents leave the local environment. Because food photos can contain sensitive incidental data such as faces, location clues, documents, or health-related context, this creates a real privacy and data-handling risk rather than a purely cosmetic issue.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The prompt sent to the model explicitly says '用中文简短回答', requiring Chinese output regardless of user preference. This is a natural-language locale policy issue because the skill hardcodes a language choice without providing an opt-in or configuration for other languages.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
        
        try:
            response = requests.post(
                "https://api.moonshot.cn/v1/chat/completions",
                headers=headers,
                json=payload,

• Confidence: 93% confidence
• Finding: This duplicate finding points to the same outbound POST call that uploads model input to Moonshot. The danger is contextual privacy leakage rather than malicious behavior: food images can still contain personally sensitive information, and the code does not present any explicit warning or consent mechanism around that transfer.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
        
        try:
            response = requests.post(
                "https://api.moonshot.cn/v1/chat/completions",
                headers=headers,
                json=payload,

• Confidence: 93% confidence
• Finding: This duplicate finding points to the same outbound POST call that uploads model input to Moonshot. The danger is contextual privacy leakage rather than malicious behavior: food images can still contain personally sensitive information, and the code does not present any explicit warning or consent mechanism around that transfer.

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
            response = requests.post(
                "https://api.moonshot.cn/v1/chat/completions",
                headers=headers,
                json=payload,
                timeout=60

• Confidence: 92% confidence
• Finding: The hardcoded Moonshot API endpoint confirms that data is transmitted to a third-party network destination. While using an external API is not inherently malicious, the lack of disclosure and choice makes the privacy impact material in a consumer health-adjacent skill handling user images.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This shell script presents its title, usage guidance, and status messages entirely in Chinese, which enforces a specific language for users regardless of their preference. The file does not offer any language selection, fallback, or justification that it is intended only for a Chinese-speaking or region-specific audience.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The top manifest metadata identifies the skill as calorie-detective-v2-0-0, but the main document title says '热量侦探 v3.0.0' and the changelog marks v3.0.0 as the formal release. This creates an intent/documentation contradiction about which version the skill actually represents, which can mislead reviewers about expected behavior and release state.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The phrase '中文优化 - 专为中餐优化' indicates a locale-specific bias in behavior and presentation. Because the file does not offer user opt-in or clarify that this regional focus is optional or context-limited, it may conflict with language/locale choice expectations.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The display name and slogan are presented only in Chinese, which indicates a fixed language choice in the skill's user-facing metadata. Under the language/locale policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a policy concern.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: This YAML file defines configuration for a skill but provides no explicit trigger phrases, activation constraints, or exclusion conditions. For manifest/config-style files, the absence of invocation scope can make it unclear when the skill should activate versus when it should not, which increases the risk of unintended use.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Food Calorie Calculator Dependencies
requests>=2.28.0
pyyaml>=6.0
Pillow>=9.0.0

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens supply-chain control and makes it impossible to guarantee that a safe, tested version of requests is installed, especially given the package's history of security advisories.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Because requests is not pinned, the manifest provides no assurance that installations avoid known vulnerable releases. In a skill that may contact external services, this uncertainty can expose users to issues such as credential leakage or TLS/verification-related flaws present in older versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Food Calorie Calculator Dependencies
requests>=2.28.0
pyyaml>=6.0
Pillow>=9.0.0

• Confidence: 98% confidence
• Finding: PyYAML is security-sensitive because unsafe or vulnerable versions can expose deserialization and input-validation risks. Leaving it unpinned means deployments may install different releases, making it hard to ensure a patched version is consistently used.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: PyYAML has a history of high-risk issues, including unsafe deserialization behavior, and the unpinned requirement means a vulnerable version could be installed without notice. Even if the current file is only a manifest, the inability to verify the resolved version is a real supply-chain and runtime risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Food Calorie Calculator Dependencies
requests>=2.28.0
pyyaml>=6.0
Pillow>=9.0.0

• Confidence: 97% confidence
• Finding: Pillow processes attacker-influenced image data in a photo-based calorie detection skill, so dependency drift is more dangerous here than in a non-image-processing tool. An unpinned version can result in deploying a release with known image parsing flaws or resource-exhaustion issues.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow handles untrusted image content, and this skill's core function explicitly processes user-supplied food photos, which raises the danger of vulnerable image-decoding libraries. Since the dependency is unpinned, it is impossible to confirm that deployed versions are free from known code execution, overflow, or denial-of-service issues.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The script's user-facing comments and usage output are in Chinese only, including the invocation guidance shown to users. This imposes a specific language/locale without offering a choice or documenting a justified locale restriction.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill accesses credential material from USER_KIMI_API_KEY, KIMI_API_KEY, and later from config-loaded api_keys. Although using credentials is expected for API access, the file provides no user-facing notice that it reads sensitive secrets from the environment or local config.

Static analysis

No suspicious patterns detected.