Security audit
Security checks for vulnerabilities and agentic risk
This food-logging skill is purpose-aligned and disclosed, with local meal storage after confirmation, but users should understand it may analyze broad food-like prompts and store dietary history locally.
Install only if you want ClawCoach to analyze meal photos or food descriptions and keep a local dietary log. Review ambiguous photo or casual food prompts before confirming, and remember that confirmed meals are stored under ~/.clawcoach/food-log.json using your local ClawCoach profile for targets.
The skill instructs activation whenever a user sends a photo, unless context clearly suggests otherwise. That is overly broad for a food-logging skill and can cause unintended interception of unrelated user images, increasing privacy risk and the chance of processing sensitive content without clear user intent.
Triggers like "I ate [food]" or ordinary food descriptions overlap with normal conversation and may activate the skill during casual discussion rather than a request to log data. In this skill, that can lead to unintended meal parsing, confirmation prompts, and eventual persistence of health-related data if the user responds casually.
The skill persists meal and nutrition data to a local JSON file, creating session-to-session retention of potentially sensitive health and dietary information. While storage is core to the feature, the specification lacks safeguards such as consent language, retention limits, validation for edits/deletes, and protections against cross-session misuse or accidental modification of prior entries.
- Ask: "confirm? (yes / edit / redo)"
3. **Handle response:**
- **"yes" / "confirm"** — Write the meal to `~/.clawcoach/food-log.json` with status "confirmed"
- **Correction** (e.g., "the rice was brown rice" or "it was more like 8oz") — recalculate and present updated totals
- **"redo"** — ask for a new photo or text description
No suspicious patterns detected.