fridge-keeper

冰箱食物管理助手。用于记录食物的入库与出库、追踪保质期、提醒临期食品、提供烹饪建议。当用户说"我的冰箱里有什么"、"检查过期食品"、"推荐菜谱"、"记录入库"或"记录出库"时触发此技能。

Security Scan

The skill's code and instructions mostly match the stated fridge-management purpose, but there are notable inconsistencies and some risky choices (config file location mismatch, plaintext-stored DB credentials, and minor database-code bugs) that you should review before installing.

Purpose & Capability

The name/description (fridge inventory, expiry tracking, recipe suggestions) aligns with the included storage.py and SKILL.md. It reasonably supports local file storage and optional remote databases. No unrelated credentials or binaries are requested. However, the SKILL.md says the agent will save configuration under ~/.claude/skills/fridge-keeper/config.json while the code uses a different CONFIG_PATH (the skill package root ./config.json). This mismatch means the instructions and code are inconsistent and could cause confusion or misplacement of stored data/credentials.

Instruction Scope

SKILL.md limits operations to asking users for storage choice, reading/writing config, and manipulating fridge items. It does not instruct reading arbitrary system files or exfiltrating data. The main scope issue is the config path inconsistency described above (instructions instruct to write to ~/.claude/..., code writes to the skill folder). The instructions also imply asking users for DB credentials which will then be written to disk by the code.

Install Mechanism

No install spec is provided (instruction-only plus a Python helper file). That's low-risk. The code may import database client libraries (mysql-connector-python, psycopg2, pymongo) at runtime if database mode is selected — these would need to be installed in the environment, but the skill does not automatically download arbitrary code from external URLs.

Credentials

The skill requests database connection information when the user chooses remote DB storage; that is proportionate to a DB-backed mode. However, the code will persist configuration (including DB username/password) to a JSON file in the skill directory (per current CONFIG_PATH) or to the path the SKILL.md names — both approaches store credentials in plaintext. Storing DB credentials in an unprotected JSON file is a security/privacy concern and should be called out to users. Also, PostgreSQL cursor usage in the code appears incorrect (cursor(dictionary=True)), suggesting the DB codepaths are untested and error-prone.

Persistence & Privilege

The skill does not request 'always: true' or elevated platform privileges. It writes its own configuration and data files (normal for this kind of utility). The primary risk is local storage of credentials and data; there is no evidence of the skill attempting to modify other skills or agent-wide settings.

What to consider before installing

This skill appears to implement a legitimate fridge-inventory helper, but review these issues before installing: - Config path mismatch: SKILL.md says configs go in ~/.claude/skills/fridge-keeper/config.json, but the Python code writes/reads ./config.json next to the skill. Confirm which path will be used and change it if you want configs in your home directory. - Plaintext credentials: If you choose remote-database mode the skill will store DB host/username/password in a JSON file. Prefer local storage mode or ensure the config file is placed in a secure location with restrictive permissions; avoid putting production DB credentials here. - Database code quality: The PostgreSQL implementation uses a cursor call (cursor(dictionary=True)) that is not standard for psycopg2 and may fail; test DB mode in a sandbox first. The code also builds SQL SET clauses from dictionary keys (these keys should be controlled by the skill, but be cautious if you plan to feed untrusted input into update keys). - No hidden network exfiltration found: The code only connects to user-provided DB hosts and does not call external web endpoints. Still, giving DB credentials grants network access to the DB host — only use credentials you trust. Recommendations: 1) Prefer local storage (default file) unless you need remote DB. 2) If using DB, use temporary or limited-privilege credentials and bind DB to localhost or a trusted network. 3) Inspect or modify CONFIG_PATH to a safe location and secure the file (restrict permissions). 4) If you are not comfortable editing code, ask the author to: a) fix the config path to match SKILL.md or SKILL.md to match code, b) avoid storing plaintext secrets or document encryption/permission steps, and c) fix/testing for PostgreSQL cursor usage. 5) Test the skill in an isolated environment before granting it access to important data/credentials.

冰箱管家 (Fridge Keeper)

概述

管理冰箱食物的入库、出库、保质期追踪与烹饪建议。支持本地文件存储和远程数据库两种模式。

核心能力

1. 食物入库 - 记录食物名称、数量、入库时间、保质期
2. 食物出库 - 记录食物被消耗或丢弃
3. 查询食物 - 查看当前冰箱中的所有食物
4. 临期检查 - 识别将在指定天数内过期的食物
5. 烹饪建议 - 根据现有食材和临期情况推荐菜谱

数据模型

食物条目 (FoodItem)

{
  "id": "uuid",
  "name": "食物名称",
  "quantity": 数量,
  "unit": "单位(克/个/颗等)",
  "storage_location": "冷藏室/冷冻室/保鲜层",
  "入库时间": "2024-01-15T10:30:00Z",
  "保质期天数": 7,
  "过期时间": "2024-01-22T10:30:00Z",
  "状态": "active|consumed|expired"
}

配置 (Config)

{
  "storage_type": "local|database",
  "local_path": "./fridge_data.json",
  "database": {
    "type": "mysql|postgres|mongodb",
    "host": "localhost",
    "port": 3306,
    "database": "fridge",
    "username": "user",
    "password": "pass"
  },
  "expiry_warning_days": 3,
  "reminder_schedule": "daily|weekly|custom"
}

工作流程

首次初始化

当用户首次使用或说"初始化配置"、"设置冰箱"时：

1. 询问存储方式

   • "请选择数据存储方式：(1) 本地文件 (2) 远程数据库"
   • 若选本地：使用默认路径 ./fridge_data.json 或询问用户指定路径
   • 若选数据库：询问数据库类型、连接信息

2. 配置提醒

   • "设置临期提醒天数（默认3天）"
   • "设置提醒方式：每日/每周/自定义"

3. 保存配置

   • 将配置写入 ~/.claude/skills/fridge-keeper/config.json

食物入库

当用户说"入库"、"放进冰箱"、"添加食物"时：

1. 解析食物信息

   • 名称（必填）
   • 数量和单位
   • 存放位置（冷藏室/冷冻室/保鲜层）
   • 保质期天数（冷藏食物必填，冷冻食物可省略或设更长）

2. 计算过期时间

   • 过期时间 = 当前时间 + 保质期天数
   • 冷冻食品默认保质期 180 天

3. 写入存储

   • 生成唯一 ID
   • 追加到存储

4. 确认入库

   • 汇报入库成功，包含过期时间

食物出库

当用户说"出库"、"吃掉"、"拿出冰箱"、"消耗"时：

1. 识别食物

   • 匹配用户提到的食物名称
   • 若有多个匹配，询问具体是哪个

2. 更新状态

   • 消耗：状态改为 consumed，记录消耗时间
   • 丢弃：状态改为 expired，记录丢弃时间

3. 确认出库

   • 汇报出库成功

查询食物

当用户说"有什么"、"查看冰箱"、"当前食物"时：

1. 读取活跃食物

   • 从存储读取状态为 active 的条目

2. 按位置分组

   • 冷藏室 / 冷冻室 / 保鲜层

3. 格式化输出

   • 列出每类食物，包含名称、数量、剩余保质期

临期检查

当用户说"临期"、"快过期"、"检查过期"时：

1. 计算临期阈值

   • 临期 = 过期时间 - 警告天数 ≤ 当前时间

2. 筛选临期食物

   • 状态为 active
   • 过期时间 ≤ 当前时间 + 警告天数

3. 按紧急程度排序

   • 已过期 > 今天过期 > 明天过期 > 即将临期

4. 输出警告

   • 清晰标注紧急程度

烹饪建议

当用户说"推荐菜谱"、"做什么菜"、"建议"时：

1. 获取当前食物

   • 读取所有 active 状态的食材

2. 识别临期食材

   • 优先考虑即将过期的食材

3. AI 自主推荐

   • 利用自身的烹饪知识，根据现有食材推荐合适的菜谱
   • 优先使用临期食材
   • 说明每道菜使用哪些食材（含临期标注）

4. 输出建议

   • 推荐 2-3 道菜
   • 说明每道菜使用哪些食材（含临期标注）

存储操作

核心存储操作由 scripts/storage.py 实现，支持本地文件和数据库两种模式。Claude 调用相应方法：

• load_config() - 读取配置
• save_config(config) - 保存配置
• load_items() - 读取所有食物条目
• save_item(item) - 添加新条目
• update_item(id, updates) - 更新条目
• delete_item(id) - 删除条目