Food Channel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:04 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent food tracker, but its photo-estimate workflow uses an unsafe shell command pattern with model-generated JSON, so it needs review before installation.

Install only if you are comfortable with meal photos being processed by the platform vision model and nutrition entries being stored locally. Review or patch the photo-estimate command so JSON is passed through stdin without shell interpolation, and set `FOOD_LOG` only to a trusted workspace path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43

Finding

Shell Command Injection Through Interpolated Vision-Generated JSON

Content

View full analysis

' | python3 scripts/tracker.py estimate` 6. Reply with formatted summary noting it's an **estimate** (≈) ``` ### Technical Analysis The documented workflow instructs the agent to insert JSON derived from a vision model into a single-quoted shell command: ```sh echo '' | python3 scripts/tracker.py estimate ``` JSON strings may legitimately contain apostrophes. If the placeholder is replaced through direct string interpolation, an apostrophe terminates the shell's single-quoted argument. Subsequent shell metacharacters in the generated content can then be interpreted as commands rather than data. The input is influenced by an image supplied by a user and by the response of a remote vision model. Consequently, neither the field values nor their shell safety can be assumed. Although `tracker.py estimate` safely reads JSON from standard input, the injection occurs in the shell before the Python process parses that input. For example, a model-generated item value containing a payload structurally similar to the following could break out of the quoted argument when interpolated: ```text '; attacker_command; echo ' ``` Whether a particular payload succeeds depends on how the host agent materializes the documented command. The unsafe command pattern nevertheless establishes an exploitable injection boundary when ordinary shell substitution is used. ### Attack Path 1. An attacker submits an image containing adversarial text or visual prompt-injection content. 2. The image is sent to the platform image tool as direct ...[truncated 1118 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tracker.py:75

Finding

CSV Formula Injection Through Untrusted Food Metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises photo-based nutrition estimation but provides no notice about what happens to uploaded images, whether they are sent to a third-party model or service, how long they are retained, or whether metadata may be exposed. In a food-tracking context, meal photos can reveal sensitive health, lifestyle, location, or household information, so omission of privacy and handling details can lead users to disclose sensitive data without informed consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill performs file reads/writes, uses environment variables, and makes external network/API calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime may grant broader capabilities than reviewers or operators expect, increasing the risk of unintended file access, persistent data modification, or exfiltration via the network/image-processing path.

Content

No source excerpt is available for this finding.

Tainted flow: 'LOG_FILE' from os.environ.get (line 11, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 90% confidence

Finding

The initial CSV creation path also uses LOG_FILE from an untrusted environment variable and opens it for write mode. On first run, this can create or truncate an attacker-chosen file path, which is a classic arbitrary file write primitive within the privileges of the process.

Content

Scanner excerpt · scripts/tracker.py (reported line 34)May include surrounding context.

python

def _init_csv():
    os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)
    if not os.path.exists(LOG_FILE):
        with open(LOG_FILE, "w", newline="") as f:
            writer = csv.DictWriter(f, fieldnames=FIELDNAMES)
            writer.writeheader()

Tainted flow: 'LOG_FILE' from os.environ.get (line 11, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 89% confidence

Finding

LOG_FILE is derived from the FOOD_LOG environment variable without validation and is later opened for append. If an attacker can influence the process environment, they can redirect writes to arbitrary filesystem locations, causing file clobbering, data corruption, or abuse of the skill to modify sensitive files accessible to the running user.

Content

Scanner excerpt · scripts/tracker.py (reported line 69)May include surrounding context.

python

"sodium_mg": sodium_mg,
        "extra_nutrients": json.dumps(extra_nutrients) if extra_nutrients else "",
    }
    with open(LOG_FILE, "a", newline="") as f:
        writer = csv.DictWriter(f, fieldnames=FIELDNAMES)
        writer.writerow(row)
    return row

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README states that food entries are persistently logged to a CSV file but does not warn users that potentially sensitive dietary and health-related data will be stored locally. Even if storage is only local, this can expose private information to other users, backups, sync tools, or misconfigured workspace permissions, especially on shared systems.

Content

No source excerpt is available for this finding.