Security checks across malware telemetry and agentic risk
NutriCoach mostly does what it claims, but it handles sensitive health data with under-scoped web, file, and cloud-OCR behaviors that users should review before installing.
Install only if you are comfortable storing health and diet records in local plaintext SQLite files and using an unauthenticated local web dashboard. Run the dashboard only on a trusted machine/network, prefer local OCR for private images, avoid cloud OCR unless you consent to sending photos to the configured provider, use simple usernames, and secure or encrypt exports and backups.
'--format', 'json'
]
match_result = subprocess.run(match_cmd, capture_output=True, text=True, timeout=30)
match_data = json.loads(match_result.stdout)
finally:]
try:
ocr_result = subprocess.run(ocr_cmd, capture_output=True, text=True, timeout=60)
if ocr_result.returncode != 0:
return {
"status": "error",script_path = os.path.join(SKILL_DIR, 'scripts', script_name)
cmd = ['python3', script_path, '--user', user] + list(args)
try:
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
if result.returncode == 0:
return json.loads(result.stdout)
else:```yaml vision: api_key: "your-api-key" base_url: "https://api.moonshot.cn/v1" model: "kimi-k2.5" ```
```yaml vision: api_key: "sk-xxxxx" base_url: "https://api.moonshot.cn/v1" model: "kimi-k2.5" ```
66/66 vendors flagged this skill as clean.