Photo Calorie Tracker

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.0

Overview

This calorie-tracking skill does what it says, but it stores meal photos and calorie logs locally.

Install only if you are comfortable with food photos and calorie history being saved in the local OpenClaw workspace. Review or delete `/root/.openclaw/workspace/temp_qqdata/` and `/root/.openclaw/workspace/memory/` if you do not want those records retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs persistent storage of user food images and daily calorie records under fixed local paths without any notice, consent flow, retention policy, or minimization guidance. Because food photos and dietary logs can reveal sensitive health and lifestyle information, silent disk storage increases privacy risk, accidental disclosure risk, and cross-session data exposure on shared systems.

VirusTotal

51/51 vendors flagged this skill as clean.