Food Channel
v1.0.1Handle messages in a food-tracking channel by routing food intake events through a deterministic food tracker. Use when working in a dedicated food channel,...
⭐ 0· 29·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name and description (food tracking, barcode lookups, photo estimates, summaries) match the included script and SKILL.md. Required actions — reading/writing a workspace data directory, calling Open Food Facts, and using an image/vision tool — are all relevant to the stated purpose. Note: the SKILL.md declares FOOD_CHANNEL_ID as required, but the registry metadata at the top lists no required env vars; this is a packaging/documentation mismatch, not a functional mismatch.
Instruction Scope
Instructions stay within the food-tracking domain: parsing messages, invoking scripts (tracker.py), copying/resizing images, calling the platform 'image' tool, and reading/writing profile and log files under $WORKSPACE/data/. Important privacy-related note: the 'image' tool may send images to a remote vision model (explicitly stated), so photos provided by users will likely leave the local environment. The SKILL.md also instructs use of external binary 'convert' (imagemagick) or PIL fallback — both reasonable but dependent on host capabilities.
Install Mechanism
No install spec — instruction-only skill with a bundled Python script. Nothing in the manifest downloads or executes arbitrary remote archives. This is a low-risk install footprint; the included script is plain Python and appears readable.
Credentials
The skill uses workspace-related env vars (WORKSPACE, FOOD_LOG, FOOD_PROFILE_PATH) and requires FOOD_CHANNEL_ID per SKILL.md. It does not request secrets or unrelated service credentials. The only inconsistency is that the registry metadata listed 'Required env vars: none' while SKILL.md requires FOOD_CHANNEL_ID (and documents optional WORKSPACE/FOOD_PROFILE_PATH/FOOD_LOG). No sensitive tokens/keys are requested by the skill.
Persistence & Privilege
always:false (normal). The skill writes and reads files in the workspace (data/food_log.csv, resized images temporarily, and profile JSON) which is appropriate for its purpose. It does not request to modify other skills or system-wide agent settings.
Assessment
This skill appears to do what it says, but review these before installing: 1) Provide/verify FOOD_CHANNEL_ID and optionally FOOD_PROFILE_PATH; the registry metadata omitted these env var requirements so double-check configuration. 2) Photos: the skill uses the platform 'image' tool which may send images to a remote vision model — do not enable if you cannot share images externally. 3) Logs and images are written to $WORKSPACE/data/ — ensure this location is acceptable and has proper permissions and retention policy. 4) Network calls go to world.openfoodfacts.org (public API) and the platform image service; confirm your environment permits/monitors those outbound requests. 5) The bundled Python script is readable and straightforward, but if you have strict data-handling requirements, inspect or run it in a sandbox before granting access to production data.Like a lobster shell, security has layers — review code before you run it.
latestvk97dpmda3zm5rnb7zg2qkxadw98483vn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.