OpenCal
ReviewAudited by ClawScan on May 10, 2026.
Overview
OpenCal is a coherent instruction-only integration that uses your OpenCal API key to read and update meal logs and goals, with the main cautions being account access, persistent changes, and personal nutrition data exposure to the agent.
This skill appears safe for its stated purpose if you are comfortable giving your agent an OpenCal API key. Before installing, understand that the agent can read your food logs, add or delete entries, and change calorie or macro goals; keep the API key private and review account changes for accuracy.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can change your OpenCal records and goals when following the skill instructions.
The skill documents direct API calls that add meal logs, update nutrition goals, and delete log entries. These are expected for the stated purpose, but they are account-mutating actions.
curl -s -X POST ... /api/v1/food/log ...; curl -s -X PUT ... /api/v1/goals ...; curl -s -X DELETE ... /api/v1/food/log/{id}Use the skill when you want the agent to make these changes, and review confirmations or app history for mistakes.
If the API key is exposed or misused, someone could access or modify your OpenCal meal and goal data.
The skill requires a bearer API key for the user's OpenCal account. This is appropriate for the integration, but it grants account access to whoever can use the configured environment.
export OPENCAL_API_KEY="sk_your-key-here" ... -H "Authorization: Bearer $OPENCAL_API_KEY"
Store the API key securely, revoke or rotate it if exposed, and ensure any OPENCAL_BASE_URL override points only to a trusted OpenCal endpoint.
Your food logs, calories, macros, and related nutrition details may be visible in the agent session.
The skill retrieves meal history and nutrition totals into the agent conversation for summarization. This is purpose-aligned, but the data can be personally sensitive.
"What did I eat today?" | Fetch today's log and summarize ... jq '{totals, entries: [.entries[] | {name, calories, mealType}]}'Only use the skill in contexts where you are comfortable sharing meal and nutrition information with the agent.