Security checks across malware telemetry and agentic risk
This diet tracker is mostly coherent, but it also syncs meal logs to an Obsidian vault and pushes them to GitHub without clear user consent.
Review before installing. Use it only if you are comfortable with body/profile data being read locally, meal queries going to SkillBoss when the local database misses, and diet logs being stored. Disable or remove the Obsidian/GitHub sync unless you explicitly want meal logs and possibly other vault changes committed and pushed with your local Git credentials.
API_BASE = "https://api.heybossai.com/v1"
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json=body,65/65 vendors flagged this skill as clean.