abe-diet-tracker

Tracks daily diet and calculates nutrition information to help achieve weight loss goals. Use when user provides meal information, asks about calorie intake,...

Security Scan

The skill mostly matches a diet-tracking purpose, but there are unexplained mismatches (undocumented network credential, absolute filesystem access, and undisclosed Git/Obsidian sync behavior) that could lead to unexpected data exposure.

Purpose & Capability

Functionality (look up nutrition, log meals, compute TDEE) is coherent with a diet-tracker. However, the registry metadata lists no required env vars while SKILL.md and the code require SKILLBOSS_API_KEY — an inconsistency. Requiring an API key to query an external nutrition API is reasonable, but the missing declaration in the registry is a discrepancy the author should fix.

Instruction Scope

SKILL.md states it reads user profile data and writes daily memory files, which matches the scripts. But the code performs additional actions not described in SKILL.md: it reads absolute paths under /root/clawd (e.g., /root/clawd/USER.md), copies logs into an Obsidian vault path, and attempts to 'git add/commit/push' the obsidian vault. Those file operations and network pushes are broader than the skill's prose disclosure and can expose personal data.

Install Mechanism

There is no install spec (instruction-only) which reduces installer risk. However, the bundled Python scripts rely on external libraries (requests) and system tools (git, shutil) without declared dependencies. No external downloads are performed by the skill itself.

Credentials

The code uses SKILLBOSS_API_KEY from environment (os.environ) but the registry metadata omitted this requirement. It also reads /root/clawd/USER.md (sensitive profile data) and writes to /root/clawd/memory and /root/clawd/obsidian-vault; it then tries to push changes via git to 'origin'. Writing and pushing personal logs requires access to filesystem and git credentials and could leak data to a remote repo. These environment/filesystem accesses are significant and should be explicitly declared and justified.

Persistence & Privilege

The skill does not request always:true (good). However, it assumes persistent filesystem locations (/root/clawd, obsidian vault) and tries to synchronize logs to an external service (GitHub) via git commands. While the skill does not modify other skills, the attempt to push user data to a remote (unspecified) repo increases blast radius if git credentials are present — this is a privilege/impact concern.

What to consider before installing

Before installing: (1) Confirm the skill genuinely needs SKILLBOSS_API_KEY and set it only if you trust https://api.heybossai.com. (2) Be aware the scripts read /root/clawd/USER.md and will write daily logs to /root/clawd/memory and copy to /root/clawd/obsidian-vault — ensure those paths and the data they contain are acceptable. (3) The update script will attempt to run 'git add/commit/push' on the obsidian vault; this can upload your logs to whatever remote 'origin' is configured. If you do not want automatic pushes, do not install or run the scripts until the author exposes an opt-out or removes automatic git pushes. (4) Ask the publisher to fix the registry metadata to declare SKILLBOSS_API_KEY and to explicitly document any syncing/push behavior (including the target remote). (5) If you decide to try it, run in a sandboxed account or container without git credentials and with limited access to your real USER.md/obsidian data so you can verify behavior safely.

Diet Tracker

This skill helps track daily diet and achieve weight loss goals with automated meal reminders.

Trigger Conditions

User might say:

• "I had [food] for lunch/dinner"
• "What's my remaining calorie budget?"
• "How many calories have I eaten today?"
• "Log my meal"
• "Check my diet progress"

Or automatically triggered by cron job for meal reminders.

Cron Job Integration

This skill works with automated cron jobs:

• Lunch reminder: ~12:30 (checks if lunch logged, sends reminder if not)
• Dinner reminder: ~18:00 (checks if dinner logged, sends reminder if not)

Cron job system event: 饮食记录检查:午餐 or 饮食记录检查:晚餐

User Profile (Required)

The skill reads from USER.md:

• Daily calorie target (default: 1650 kcal)
• Macronutrient targets (protein/carbs/fat)
• Height, weight, age, gender, activity level (for TDEE calculation)

Activity levels:

• Sedentary (little or no exercise)
• Lightly active (light exercise 1-3 days/week)
• Moderately active (moderate exercise 3-5 days/week)
• Very active (hard exercise 6-7 days/week)
• Extra active (very hard exercise + physical job)

Workflow

When User Logs a Meal:

1. Identify food items from user's description
2. Fetch nutrition data via scripts/get_food_nutrition.py
   • MUST GET: calories(kcal), protein(g), carbs(g), fat(g)
   • Queries SkillBoss API Hub for calorie/protein/carbs/fat info
   • Falls back to references/food_database.json if needed
   • If complete nutrition data cannot be found, MUST clearly inform user of estimated values
3. Update daily log via scripts/update_memory.py
   • Saves to memory/YYYY-MM-DD.md
   • RECORD FORMAT: Food Name - XX kcal (P: XXg, C: XXg, F: XXg)
   • Calculates meal totals
   • Updates daily running totals
4. Report to user:
   • MUST REPORT: calories + protein/carbs/fat grams
   • Today's consumed / remaining calories
   • MUST REPORT: Remaining macronutrient budgets
   • Predicted weight change based on deficit/surplus

When User Asks for Status:

1. Read current day's memory file
2. Calculate totals consumed
3. Report:
   • Remaining calorie budget
   • Remaining protein/carbs/fat (if targets set)
   • Weight change prediction

Scripts

• scripts/get_food_nutrition.py: Fetches nutrition info via SkillBoss API Hub + calculates TDEE
• scripts/update_memory.py: Updates daily memory file with meal data
• references/food_database.json: Fallback database of common foods

Error Handling

Common Issues

Issue: "Cannot read USER.md" or missing user data

• Cause: User profile not configured
• Solution: Ask user for height, weight, age, gender, activity level, and calorie target

Issue: Nutrition lookup fails for uncommon foods

• Cause: Food not found in local database or SkillBoss API Hub response lacks structured data
• Solution: Ask user for approximate calorie count or use similar food from database

Issue: Multiple food items in one meal

• Cause: User says "I had pizza, salad, and coke"
• Solution: Process each item separately, sum the nutrition values

Data Format

Daily Memory Entry (memory/YYYY-MM-DD.md)

REQUIRED FORMAT — Must include calories + macronutrients:

## Diet Log

**Breakfast**: [food] - [X] kcal (P: [X]g, C: [X]g, F: [X]g)
**Lunch**: [food] - [X] kcal (P: [X]g, C: [X]g, F: [X]g)
**Dinner**: [food] - [X] kcal (P: [X]g, C: [X]g, F: [X]g)

**Daily Total**: [X] / [target] kcal
- Protein: [X] / [target]g (remaining: [X]g)
- Carbs: [X] / [target]g (remaining: [X]g)
- Fat: [X] / [target]g (remaining: [X]g)
**Predicted weight change**: [-/+ X] kg

⚠️ Strictly prohibited to record only calories while omitting macronutrient grams!

Progressive Disclosure

• Level 1 (frontmatter): Skill activation criteria
• Level 2 (SKILL.md): Full workflow instructions (this file)
• Level 3 (references/): Food database and nutrition guidelines