recipe-finder

PassAudited by ClawScan on May 1, 2026.

Overview

This is a simple recipe lookup skill that uses a disclosed public recipe API and does not request credentials, installation, persistence, or account access.

This appears safe for normal recipe lookup. Be aware that ingredient, cuisine, or meal search terms are sent to TheMealDB, but the artifacts show no credentials, code execution, persistence, or account mutation.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Your ingredient, cuisine, or meal search terms may be sent to TheMealDB to retrieve recipe results.

Why it was flagged

The skill directs the agent to use a web-fetch tool with user-derived recipe queries, which is the disclosed core function of the skill.

Skill content

`web_fetch` - Fetch recipe data from TheMealDB API ... `https://www.themealdb.com/api/json/v1/1/filter.php?i={ingredient}`

Recommendation

Use normally for recipe searches; avoid including unrelated private information in recipe queries.