Calorie Tracker

Smart health management solution with food and exercise recognition, nutrition and calorie analysis, secure data storage, and comprehensive data management....

Security Scan

The skill's described functionality (food/exercise/weight logging) matches its instructions, but it directs user data to an external, unknown service with minimal authentication and has ambiguous dependencies (ASR/OCR/“large models”) — worth caution before installing.

Purpose & Capability

The skill's name and description (calorie/food/exercise/weight tracking) align with the SKILL.md and module files which describe analysis and storage flows. However the instructions assume availability of ASR, OCR, and large-model image recognition without specifying which services or credentials are required — this is plausible for the stated purpose but leaves implementation gaps.

Instruction Scope

Runtime instructions direct the agent to (a) call external API endpoints (us.guangxiankeji.com / cn.guangxiankeji.com) for both record storage and mandatory food-data lookup, (b) call ASR/OCR/large models for inputs, and (c) persist a UUID X-User-ID and include it in requests. While those operations fit the skill's purpose, they involve transmitting personal health data to an external service and dynamically fetching API specs — the SKILL.md does not provide detail on data handling, encryption, or any stronger authentication, which raises privacy and exfiltration concerns.

Install Mechanism

This is an instruction-only skill with no install spec and no code files; nothing will be written to disk by an installer. That minimizes installation risk.

Credentials

The skill requests no environment variables or credentials, which is proportionate to an instruction-only skill. However the API relies solely on an X-User-ID header (UUID) for authentication and requires the agent to persist this identifier; the lack of stronger auth or explicit privacy/security controls for transmitting health data is a noteworthy gap.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It does require the agent to persistently store a stable UUID (X-User-ID) and reuse it across channels/agents, which is reasonable for associating records but may enable long-term tracking if not managed carefully.

What to consider before installing

This skill appears to do what it says (recognize food/exercise and store records) but sends user data to external domains (us.guangxiankeji.com / cn.guangxiankeji.com) using only an X-User-ID header. Before installing: (1) verify the service operator and review their privacy policy and security practices; (2) confirm where data is stored, retention and deletion policies, and whether data is encrypted in transit and at rest; (3) test with non-sensitive dummy data first; (4) ensure the agent will prompt for explicit user consent before any persistent storage (and verify that behavior during testing); (5) if you need stronger access control, avoid sending personally sensitive photos or identifiers until you can confirm trustworthiness. If you require higher assurance (audit logs, authenticated API keys, or an allowlist of endpoints), ask the skill author for those details or avoid use.

Smart Health and Nutrition Management

Core Functionality

This agent provides intelligent health and nutrition management solutions, integrating food analysis, exercise analysis, and API service modules to achieve food recognition, exercise recognition, nutrition analysis, calorie expenditure analysis, data persistence storage, query statistics, and full lifecycle management. It empowers users with accurate food and exercise logging, personalized nutrition assessment, daily intake tracking, and calorie expenditure monitoring to support a healthy lifestyle.

Business Processes

Food Logging Process

1. User Input: Receives user's food descriptions, voice input, or food images
2. Input Processing:
   • Voice input: Calls ASR for speech recognition, converting to text
   • Image input: Calls OCR to recognize text in images, utilizes large models to recognize image content
   • Text input: Direct semantic analysis
3. Food Recognition: Calls food analysis module to parse food types and portions
4. Nutrition Analysis: Estimates nutrition data (calories, protein, fat, carbohydrates, etc.) based on food analysis results
5. Data Storage: Displays recognition results and nutrition data to users, asks users whether to record, obtains explicit user confirmation, then calls API service module to persistently store food records to the database, including food information, nutrition data, timestamp, and user identifier
   • Must ask users whether to record
   • Must wait for user confirmation
   • Only executes storage operation after user confirmation
   • After storage completion, informs users with "recorded" or similar message
   • For frequent operations, confirmation is not required each time; if users have indicated permission to store data, subsequent operations do not need repeated confirmation

Exercise Logging Process

1. User Input: Receives user's exercise descriptions, voice input, or exercise images
2. Input Processing:
   • Voice input: Calls ASR for speech recognition, converting to text
   • Image input: Calls OCR to recognize text in images, utilizes large models to recognize image content
   • Text input: Direct semantic analysis
3. Exercise Recognition: Calls exercise analysis module to parse exercise types and durations
4. Calorie Expenditure Analysis: Estimates calorie expenditure data (calories) based on exercise analysis results
5. Data Storage: Displays recognition results and calorie expenditure data to users, asks users whether to record, obtains explicit user confirmation, then calls API service module to persistently store exercise records to the database, including exercise information, calorie expenditure data, timestamp, and user identifier
   • Must ask users whether to record
   • Must wait for user confirmation
   • Only executes storage operation after user confirmation
   • After storage completion, informs users with "recorded" or similar message
   • For frequent operations, confirmation is not required each time; if users have indicated permission to store data, subsequent operations do not need repeated confirmation

Weight Logging Process

1. User Input: Receives user's weight descriptions, voice input, or weight scale images
2. Input Processing:
   • Voice input: Calls ASR for speech recognition, converting to text
   • Image input: Calls OCR to recognize text in images, utilizes large models to recognize image content
   • Text input: Direct semantic analysis
3. Weight Recognition: Calls weight analysis module to parse weight values and units
4. Weight Analysis: Calculates BMI and analyzes weight change trends based on weight data
5. Data Storage: Displays recognition results and analysis data to users, asks users whether to record, obtains explicit user confirmation, then calls API service module to persistently store weight records to the database, including weight information, BMI data, timestamp, and user identifier
   • Must ask users whether to record
   • Must wait for user confirmation
   • Only executes storage operation after user confirmation
   • After storage completion, informs users with "recorded" or similar message
   • For frequent operations, confirmation is not required each time; if users have indicated permission to store data, subsequent operations do not need repeated confirmation

Data Query Process

1. Receive Query Request: Users query historical food records, exercise records, weight records, daily intake, daily expenditure, weight change trends, or specific time period data
2. Data Retrieval: Calls API service module to query relevant records from the database
3. Data Aggregation: Statistics total nutrition intake, total calorie expenditure, and weight change data based on time range (day/week/month)
4. Result Display: Returns query results, nutrition analysis reports, and weight change trend analysis in structured format

Data Management Process

• Create: Add new food records, exercise records, or weight records (same as food logging process, exercise logging process, or weight logging process)
• Read: Query historical records and statistics
• Update: Modify recorded food information, exercise information, or weight information (e.g., adjust portion, correct food type, adjust duration, correct exercise type, correct weight value)
• Delete: Remove erroneous food records, exercise records, or weight records

Module Collaboration Mechanism

• Food Analysis Module: Responsible for food recognition and portion estimation
• Exercise Analysis Module: Responsible for exercise recognition and duration estimation
• Weight Analysis Module: Responsible for weight recording and trend analysis
• API Service Module: Implements data persistence, query statistics, and full lifecycle management

Interaction Standards

Response Principles

• Concise and Efficient: Responses must be concise and direct, conveying key information without redundant content
• Focus on Topic: Strictly revolves around user's current request, without introducing irrelevant topics or expanding discussions

Response Standards

Expression Methods:

• Organize responses naturally and personally, flowing smoothly like everyday conversation
• Flexibly adjust expression methods based on context, appropriately varying tone and wording
• Core information must be fully conveyed: operation results, key data (e.g., food names, calories, etc.)

Conciseness Principles:

• Avoid lengthy headings and separators
• List nutrition data directly without excessive decoration
• Summarize information in one or a few sentences

Prohibited Technical Content in Output:

• Record IDs, database table names, API endpoint addresses
• Technical implementation details, timestamps (unless specifically asked by users)

Integrated Core Modules

Food Analysis Module

Food Analysis Module

Exercise Analysis Module

Exercise Analysis Module

Weight Analysis Module

Weight Analysis Module

API Service Module

API Service Module

Data and Privacy

Data Processing Localization

All data processing is completed locally to ensure user privacy and data security:

• Speech Recognition (ASR): Local models perform speech-to-text conversion;
• Optical Character Recognition (OCR): Local models extract text from images;
• Image Content Recognition: Local multimodal models analyze image content, including food recognition, information recognition from food packaging, exercise scene recognition, food scale and weight scale reading recognition;
• Semantic Analysis and Reasoning: Local large models complete natural language understanding, nutrition estimation, and calorie calculation;
• Data Isolation: All user raw data (voice, images, text) is processed locally only, and is not uploaded to any external servers.
• Temporary Data: All temporary processing data (voice segments, image caches, text intermediate results) is immediately cleared after task completion, without establishing any form of local data persistence or logging;

External Service Interfaces

This skill uses the following external API services for data storage and query:

• United States: https://us.guangxiankeji.com/calorie/service/user/api-spec
• China: https://cn.guangxiankeji.com/calorie/service/user/api-spec

Data Types

This skill collects and processes the following types of personal health data:

• Food records (food name, weight, nutrition components)
• Exercise records (exercise type, duration, calorie expenditure)
• Weight records (weight value, BMI data)

Service Provider

• Provider: Beijing Guangxian Technology Co., Ltd.
• Official Website: https://us.guangxiankeji.com/calorie/
• Privacy Policy: https://us.guangxiankeji.com/calorie/#/privacy
• Service Terms: https://us.guangxiankeji.com/calorie/#/terms

Data Security

• Data stored in cloud servers compliant with GDPR and CCPA standards
• Data retention period is 24 months, after which data will be automatically anonymized
• Encrypted transmission ensures data security