Fatsecret Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it advertises, but it can modify sensitive FatSecret health/account records and exposes delegated authentication output without strong safeguards.

Install only if you are comfortable giving the skill FatSecret API credentials and letting an agent read and modify nutrition, exercise, weight, favorites, saved meals, and profile data. Prefer manual-only use, confirm every account-changing action, avoid invoking profile_get_auth unless necessary, and install pyfatsecret from a pinned/audited version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40 and README.md:32
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

text

1. The `pyfatsecret` Python package must be installed: `pip install pyfatsecret`

The same unsafe installation instruction appears in README.md:

bash

pip install pyfatsecret

Technical Analysis

The installation documentation instructs users to install the latest available version of pyfatsecret without a version constraint, integrity hash, lockfile, or audited source revision. Consequently, the code installed and executed can change after this skill has been reviewed.

Python packages can execute code during installation or when imported. The dependency is imported by scripts/fs_runner.py and receives the FatSecret client ID and client secret when the client is constructed. A compromised, malicious, or unexpectedly changed package release could therefore access credentials, intercept health-related API data, or execute arbitrary code under the account running the skill.

Attack Path

1. An attacker compromises the dependency's package publishing account, distribution channel, or a future release.
2. A user follows the documented pip install pyfatsecret command.
3. The package manager retrieves the uncontrolled current release.
4. Malicious code executes during package installation or when pyfatsecret is imported.
5. The dependency accesses the process environment, including FatSecret credentials, or intercepts API requests and responses.
6. The attacker can exfiltrate credentials or data and execute code with the privileges of the user running the installation or skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing or invoking user. It could also expose FATSECRET_CLIENT_ID, FATSECRET_CLIENT_SECRET, and sensitive nut ...[truncated 198 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pyfatsecret to a specifically reviewed version rather than installing an uncontrolled latest release.
• Maintain a lockfile or requirements file containing cryptographic hashes, and install with hash verification such as pip install --require-hashes.
• Verify and document the canonical package name and source repository to reduce dependency-confusion and typosquatting risks.
• Review new dependency versions before updating the pin.
• Run the skill in a restricted environment with only the required credentials and network access.
• Use automated dependency vulnerability and provenance scanning in CI.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fs_runner.py:381

Finding

Delegated Authentication Response Is Printed Without Redaction

Content

View full analysis

Vulnerability Details

File Location: scripts/fs_runner.py:381-382
Vulnerability Type: Sensitive authentication data exposure through standard output
Risk Level: Medium

Complete Code Snippet:

python

def cmd_profile_get_auth(fs, args):
    _output(fs.profile_auth.profile_get_auth(user_id=args.user_id))

The relevant generic output function is:

python

def _output(data):
    """Print result as JSON to stdout."""
    print(json.dumps(data, indent=2, default=str))

Technical Analysis

cmd_profile_get_auth passes the complete result of the delegated authentication API directly to the generic JSON output function. No allowlist, field selection, or redaction is applied before serialization.

Authentication responses may contain token-, secret-, authorization-, or credential-related fields. Printing the complete object to standard output can expose such material to terminal history, process supervisors, CI logs, agent tool transcripts, model context, or other output collectors. This is particularly sensitive in an agent environment where command output may be retained or forwarded automatically.

The issue is not that credentials are hardcoded; it is that authentication information returned at runtime is handled as ordinary display data instead of protected secret material.

Attack Path

1. A user or autonomous agent invokes profile_get_auth with a user identifier.
2. FatSecret returns delegated profile authentication information.
3. The handler passes the entire response to _output.
4. _output serializes every returned field and prints it to standard output.
5. An agent transcript, logging system, terminal capture, or another party with output access retains the authentication data.
6. If reusable credentials or tokens are present, a party with access to the captured output can attempt to impersonate the affected profile and perform profile-scoped operations.

Im

...[truncated 490 chars]

Remediation

View remediation

Remediation Suggestions

• Do not print the complete profile_get_auth response.
• Return only a success indicator and explicitly approved non-sensitive profile metadata.
• Apply an allowlist of output fields rather than relying exclusively on a denylist.
• As defense in depth, recursively redact fields whose names indicate secrets, tokens, authorization headers, passwords, or credentials.
• Store delegated authentication material in a protected credential store with restrictive access controls.
• Prevent authentication responses from entering agent transcripts, application logs, telemetry, or exception messages.
• Add tests that provide representative nested authentication responses and verify that no sensitive values appear on standard output or standard error.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

| Endpoint | Method | Data sent |
|---|---|---|
| `https://platform.fatsecret.com/rest/v2/server.api` | POST | OAuth 2.0 bearer-token authorized requests: method name, search terms, food/recipe/entry IDs, dates, serving sizes, weight values. No raw user content beyond search queries. |
| `https://oauth.fatsecret.com/connect/token` | POST | OAuth 2.0 client credentials grant (client_id, client_secret) to obtain access tokens. |

No other endpoints are contacted. All network calls are made by the `pyfatsecret` Python package via the `requests` library.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes capabilities like logging meals, tracking weight, and managing exercises without prominently warning that these actions modify a user's health/account records. Because the domain is personal health data, users and agent frameworks may underestimate the sensitivity and permanence of these operations, leading to accidental data changes or privacy-impacting actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states the skill is invoked automatically when it matches a request, but it does not define clear trigger boundaries or require confirmation before running state-changing commands. In a skill that can log meals, edit diary entries, and update weight, broad auto-invocation increases the chance of unintended account modifications from ambiguous prompts or agent misclassification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares access to sensitive environment variables in metadata but does not define an explicit tool scope such as permissions or allowed-tools. That makes the privilege boundary unclear to the host agent and can allow broader-than-expected invocation or environment access, especially in platforms that rely on declarative scoping for enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states it may be invoked autonomously whenever the agent determines a request matches broad food and diary capabilities. Because the skill performs profile, diary, favorites, exercise, and weight operations, broad autonomous matching increases the chance of unintended access to health-related data or accidental state-changing actions without sufficiently narrow user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The security manifest lists only environment variables, endpoints, and local file access, but omits that the script performs remote writes and deletions to food diaries, saved meals, favorites, exercise entries, and weight logs. In a security-review or agent-execution pipeline, this understatement can cause the tool to be classified as lower risk than it really is, enabling unsafe use of high-impact account-modifying actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents itself as a generic CLI dispatcher, but it exposes numerous state-changing operations against a user's FatSecret profile, including creating, editing, copying, and deleting entries. In an agent-skill context, this mismatch increases the risk that a caller or reviewer underestimates the tool's ability to modify remote account data, leading to unintended or unauthorized actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.