Security audit

Calorie Counter

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local calorie tracker, but it can automatically save food and weight details from broad food mentions into a persistent local database.

Install only if you are comfortable with calorie, protein, food, goal, and weight history being saved locally in calorie_data.db. Be explicit with the agent that it should log food or weight only when you ask it to, and avoid using it in shared or synced workspaces unless you are comfortable with that plaintext database being readable through local files or backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This markdown file includes a 'Deleting Mistakes' section and a direct command example for deleting an entry, but it does not disclose whether the deletion is permanent or advise users to review entries before removing them. For markdown files, omitting warnings about behaviors that affect user data qualifies as a missing user warning.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The README describes automatic agent use when the user mentions food or calories, but this section does not warn that the interaction will create persistent records. Although the database is documented later, users are not clearly warned at the point where automatic invocation and data capture are introduced.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The phrase "English language" presents a language restriction as a feature, which can indicate the skill is intended to force a specific language. The file does not offer a user language choice or explain a justified locale-specific requirement.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description says to use the skill when the user 'mentions food they ate,' which is a very broad condition that can overlap with ordinary conversation rather than an explicit request to track intake. The file does not provide exclusion conditions or negative examples clarifying when casual discussion of meals should not activate the skill.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README states that the skill stores data in SQLite, but it does not clearly warn users that their food intake, calorie goals, and weight entries are persisted locally over time. Because this behavior affects user privacy and personal data retention, the markdown description should disclose it more explicitly as a user-facing warning.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.