Plan2meal

• Analyzed: May 16, 2026, 3:01 AM
• Findings: 1
• Version: 1.2.5
• Hash: 84e0e2bb7100a18959acf02f550fb03334308800eba3ca86b7534010451f6f9d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Plan2Meal appears benign. It provides recipe and grocery list management by interacting with a Convex backend and standard OAuth providers (GitHub, Google, Apple). The code is well-structured, uses `axios` for network requests, and includes `markdownEscape` for output sanitization. There is no evidence of intentional data exfiltration, malicious execution (e.g., `eval`, `child_process`), persistence mechanisms, or obfuscation. The `SKILL.md` and `README.md` files contain appropriate guardrails and transparency disclosures regarding data routing and backend usage, without any signs of prompt injection attempts to manipulate the agent into harmful actions. The delegation of recipe URL fetching and parsing to the Convex backend (via `src/convex.ts` and `src/commands.ts`) shifts potential web scraping vulnerabilities to the backend service, rather than being a direct flaw or malicious intent within the skill itself.