Mealmastery
v1.0.1Plan meals, manage recipes, and build grocery lists with AI through natural language conversation.
⭐ 1· 104·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (meal planning, recipes, grocery checkout) match the declared requirements: node + an @mealmastery npm package and a MEALMASTERY_API_KEY API key. Nothing requested (binaries/env) appears unrelated to the stated purpose.
Instruction Scope
SKILL.md instructs adding an mcpServers entry to ~/.openclaw/config.json to launch the MCP server via npx and to provide the MEALMASTERY_API_KEY. All runtime actions described (generate meal plans, create grocery lists, optionally checkout to providers like Instacart/Kroger) fall within the skill's stated scope. Note: checkout operations can perform real cart additions/orders—guardrails recommend dry_run and explicit user confirmation, which should be enforced in practice.
Install Mechanism
Install is via an npm package (@mealmastery/mcp-server) invoked with npx; this is expected for a Node-based MCP bridge. This is moderate-risk (runtime package fetch) but not unusual or opaque — no downloads from arbitrary URLs or IPs are used.
Credentials
Only a single required environment variable (MEALMASTERY_API_KEY) is declared and used; it is the primary credential for the service and is justified by the skill's purpose. No unrelated secrets or multiple credentials are requested.
Persistence & Privilege
The skill does not request always:true and can be user-invoked. It does instruct the user to modify ~/.openclaw/config.json to register an MCP server so the package can run; this is a local config change (normal for MCP-style skills) but users should be aware it persists a command that will be run (via npx) when invoked.
Assessment
This skill appears internally consistent with its stated purpose, but before installing: (1) verify the npm package and GitHub repo (https://github.com/MealMasteryAI/mcp-server) and inspect the package/source if you can, since npx will fetch/execute it at runtime; (2) create an API key with limited scope or a test account and avoid using a privileged account; (3) be careful with checkout actions — always confirm dry_run previews before allowing real checkouts to Instacart/Kroger; (4) back up ~/.openclaw/config.json before modifying it, and ensure the MEALMASTERY_API_KEY is stored securely (rotate it if leaked); (5) if you need higher assurance, request the package source and audit it or run the MCP server in an isolated environment.Like a lobster shell, security has layers — review code before you run it.
cookingvk9722262naj0yhf2xrsmn55fd1839wfydietvk9722262naj0yhf2xrsmn55fd1839wfyfoodvk9722262naj0yhf2xrsmn55fd1839wfygroceryvk9722262naj0yhf2xrsmn55fd1839wfyinstacartvk9722262naj0yhf2xrsmn55fd1839wfykrogervk9722262naj0yhf2xrsmn55fd1839wfylatestvk9751d0d4rkf8zbmk9mwyn22sn83bs6xmeal generationvk9722262naj0yhf2xrsmn55fd1839wfymeal-planningvk9722262naj0yhf2xrsmn55fd1839wfymeal-prepvk9722262naj0yhf2xrsmn55fd1839wfynutritionvk9722262naj0yhf2xrsmn55fd1839wfyrecipesvk9722262naj0yhf2xrsmn55fd1839wfyshopping-listvk9722262naj0yhf2xrsmn55fd1839wfyweekly-plannervk9722262naj0yhf2xrsmn55fd1839wfy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🍽️ Clawdis
OSmacOS · Linux · Windows
Binsnode
EnvMEALMASTERY_API_KEY
Primary envMEALMASTERY_API_KEY
Install
Node
npm i -g @mealmastery/mcp-server