Half Full
v0.1.4半饱 — 生活的高潮所在。A mindful eating companion for desk workers. Track meals with photos, understand your body's needs, no gym guilt.
⭐ 0· 923·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (mindful eating companion) align with included scripts and data: meal logging (scripts/log.py), profile and expenditure (scripts/profile.py), a local food DB (scripts/food_db.py), and Apple Health parsing (scripts/health_sync.py). Required binary is only python3 and no external credentials or config paths are requested — proportionate for the stated purpose.
Instruction Scope
Runtime instructions and AGENT_GUIDE direct the agent to parse messages tagged '[半饱数据]' and persist activity/weight and meal logs locally. The AGENT_GUIDE explicitly documents '隐性' (silent) inference of menstrual cycles from eating/weight patterns and guidance to '静默调整' behavior without surfacing the inference. That is a privacy/ethics concern: the skill is designed to capture and act on sensitive health signals without explicit, visible consent. The scripts do not appear to read arbitrary system files or send data externally, but stored records include user-local absolute photo paths (e.g., /Users/...), which could expose local paths in logs/responses.
Install Mechanism
This is an instruction+code skill with no installer spec in the registry (lowest risk). SKILL.md contains an 'install: "pip3 install -q"' line which is odd/ambiguous because no packages are named; the code itself only uses Python stdlib. The ambiguous install line should be clarified (it currently does nothing or could be misused by an installer). No network downloads or external packages are referenced in code.
Credentials
The skill requests no environment variables, no external credentials, and no config paths. All file I/O is to a data/ folder inside the skill directory (scripts compute a local data path), which is proportional to a local logging assistant.
Persistence & Privilege
always:false (not force-included). disable-model-invocation:false (default) — the skill can be invoked autonomously by the agent. Combined with the AGENT_GUIDE's direction to automatically parse incoming messages that contain '[半饱数据]' and silently infer sensitive states, this autonomous invocation increases privacy risk. The skill writes persistent local records (activity.json, weight.json, log-*.json) inside its data folder; it does not modify other skills or system-wide settings.
What to consider before installing
What to consider before installing:
- Data storage and privacy: the skill stores meal logs, weight, and activity locally (data/*.json). It may save file paths to photos from your machine in logs; although the scripts do not upload photos, those paths can appear in stored records and responses. Review where the skill will be installed so you control the data directory.
- Silent health inferences: AGENT_GUIDE documents that the agent should silently infer menstrual cycles and '静默调整' behavior (i.e., make private inferences without telling the user). That is sensitive behavior — decide whether you want a tool that infers and acts on such signals without explicit user-visible consent.
- Ambiguous install instruction: SKILL.md has 'pip3 install -q' with no packages listed. This looks like a placeholder or mistake; confirm there is no hidden installer step before running anything. The provided Python scripts use only the standard library.
- Autonomous invocation: by default the agent can call this skill automatically; combined with automatic parsing of incoming messages, this can lead to data being recorded without explicit, immediate user confirmation. If you do not want automatic parsing, disable autonomous invocation or require explicit invocation.
- Practical checks: inspect/verify the directory where data will be written, and inspect the AGENT_GUIDE/README for any behavior you disagree with. If you proceed, consider (1) backing up or removing any sensitive photo paths from sample data, (2) running the scripts in a sandbox or with restricted agent permissions, and (3) confirming there are no network calls or added installers before granting broader access.
If you want, I can: list exactly which files will be written/modified by each script, or suggest minimal changes to make the inference behavior explicit and privacy-respecting.Like a lobster shell, security has layers — review code before you run it.
latestvk97cqh5akrhepprk3fwtv810e181s5yb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🍃 Clawdis
Binspython3
