Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Health Buddy Pro
v1.0.3Stop spending 10 minutes typing out every ingredient into a clunky food logging app. Health Buddy Pro lets you snap a photo of your meal and get exact calori...
⭐ 0· 69·0 current·0 all-time
by@nollio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description, SKILL.md, and included script consistently implement local photo-based meal logging and local storage of logs — no credentials or external services are required by default. However, the repository also contains a dashboard-kit and SQL schema mentioning Supabase/Nollio cloud backends and 'sync' options; that creates an optional cloud integration path that contradicts the README/SECURITY.md's strong 'local-only' claim. The presence of that cloud dashboard material is plausible as an opt-in feature but is worth noting because it increases the potential blast radius if enabled.
Instruction Scope
SKILL.md instructs the agent to use vision tools to extract food items and to read/write local files under data/ (e.g., data/nutrition-log.json). The instructions include robust prompt-injection defenses and explicitly treat extracted text as data not instructions. However, the pre-scan detected prompt-injection patterns (e.g., 'ignore-previous-instructions' and 'unicode-control-chars') inside SKILL.md — while they appear to be present as examples of malicious payloads that should be ignored, their presence increases risk and should be manually inspected to ensure there are no hidden control characters or ambiguous examples that could be mis-parsed. The instructions also rely on the host agent's 'image' tool/vision capability; you should verify how that tool handles images (local vs remote processing).
Install Mechanism
There is no external install spec and the only executable is a small shell initializer (scripts/health-buddy-init.sh) that creates local data/config directories with secure permissions and refuses symlinked targets. The shell script appears to avoid writing outside the skill directory, but its workspace-root detection loop is trivial (effectively uses current directory) — meaning if run from an unexpected working directory it will create/operate under that cwd's skills/ path. No downloads, no external URLs, and no packages are installed by the skill itself.
Credentials
The skill requests no environment variables, no credentials, and no config paths beyond its own skill directory. That is proportionate to a local meal-logging skill. The only notable point is the repository's documentation for optional cloud/back-end usage (Supabase) which would require credentials if the user elects to enable it; those credentials are not required by default.
Persistence & Privilege
The skill does create and write to local files under skills/health-buddy-pro/data, which is expected for a logging tool. It does not request always:true, does not require elevated system privileges, and contains checks rejecting symlinked paths to prevent writes escaping the skill directory. It does not modify other skills' configurations in the provided files.
Scan Findings in Context
[prompt-injection:ignore-previous-instructions] expected: SKILL.md explicitly discusses prompt injection and gives examples of malicious commands (e.g., 'ignore previous instructions'); the scanner flagged this pattern. This is likely intentional as a defensive example, but it should be inspected to ensure the example isn't embedded in a way that could be interpreted as an instruction by some agents.
[unicode-control-chars] unexpected: The scanner flagged unicode control characters in the SKILL.md. The skill's content mentions prompt-injection defenses and examples; however, presence of hidden unicode control characters can be used to obfuscate malicious instructions. The file should be audited (displaying hidden characters) before trusting the package.
What to consider before installing
Summary of what to check before installing:
- Inspect the SKILL.md and other text files in a viewer that shows hidden characters (e.g., cat -v, a hex editor) to ensure there are no concealed unicode control characters or embedded instructions. The pre-scan flagged such characters.
- Confirm how your agent's 'image' / vision tool processes images: does it run locally, or does it send images to an external API? The skill assumes local processing; if your agent forwards images to a cloud service, health photos could leave your device.
- The repo claims 'local-only' storage, which is true for the default behavior, but a dashboard-kit and Supabase/Postgres schema are included for optional cloud-backed setups. Only enable cloud sync/backups if you understand and trust the remote service and supply credentials consciously.
- Review scripts/health-buddy-init.sh before running. It enforces secure permissions and symlink checks, but its workspace detection is simplistic — run it from the intended workspace root or inspect where it will create files.
- Treat the 'Codex Security Verified' audit as an author-provided statement; if you need stronger assurance, run the skill in a sandboxed environment (or inspect network activity) to confirm it makes no outbound connections.
If any of the above checks raise doubts, prefer running the skill in an isolated/sandbox workspace or decline installation until you can verify hidden characters and the image-processing behavior.SKILL.md:35
Prompt-injection style instruction pattern detected.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.Like a lobster shell, security has layers — review code before you run it.
latestvk97469qakqeyxyspa9bnt10fdh83zt0d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.