Food Channel

Handle messages in a food-tracking channel by routing food intake events through a deterministic food tracker. Use when working in a dedicated food channel,...

Security Scan

The skill's code and runtime instructions are consistent with a food-tracking channel: it logs entries to workspace CSVs, looks up barcodes via Open Food Facts, and uses the platform image tool for photo estimates; nothing in the bundle requests unrelated credentials or installs unusual software.

Purpose & Capability

The skill's name and description (food tracking, barcode lookups, photo estimates, summaries) match the included script and SKILL.md. Required actions — reading/writing a workspace data directory, calling Open Food Facts, and using an image/vision tool — are all relevant to the stated purpose. Note: the SKILL.md declares FOOD_CHANNEL_ID as required, but the registry metadata at the top lists no required env vars; this is a packaging/documentation mismatch, not a functional mismatch.

Instruction Scope

Instructions stay within the food-tracking domain: parsing messages, invoking scripts (tracker.py), copying/resizing images, calling the platform 'image' tool, and reading/writing profile and log files under $WORKSPACE/data/. Important privacy-related note: the 'image' tool may send images to a remote vision model (explicitly stated), so photos provided by users will likely leave the local environment. The SKILL.md also instructs use of external binary 'convert' (imagemagick) or PIL fallback — both reasonable but dependent on host capabilities.

Install Mechanism

No install spec — instruction-only skill with a bundled Python script. Nothing in the manifest downloads or executes arbitrary remote archives. This is a low-risk install footprint; the included script is plain Python and appears readable.

Credentials

The skill uses workspace-related env vars (WORKSPACE, FOOD_LOG, FOOD_PROFILE_PATH) and requires FOOD_CHANNEL_ID per SKILL.md. It does not request secrets or unrelated service credentials. The only inconsistency is that the registry metadata listed 'Required env vars: none' while SKILL.md requires FOOD_CHANNEL_ID (and documents optional WORKSPACE/FOOD_PROFILE_PATH/FOOD_LOG). No sensitive tokens/keys are requested by the skill.

Persistence & Privilege

always:false (normal). The skill writes and reads files in the workspace (data/food_log.csv, resized images temporarily, and profile JSON) which is appropriate for its purpose. It does not request to modify other skills or system-wide agent settings.

Assessment

This skill appears to do what it says, but review these before installing: 1) Provide/verify FOOD_CHANNEL_ID and optionally FOOD_PROFILE_PATH; the registry metadata omitted these env var requirements so double-check configuration. 2) Photos: the skill uses the platform 'image' tool which may send images to a remote vision model — do not enable if you cannot share images externally. 3) Logs and images are written to $WORKSPACE/data/ — ensure this location is acceptable and has proper permissions and retention policy. 4) Network calls go to world.openfoodfacts.org (public API) and the platform image service; confirm your environment permits/monitors those outbound requests. 5) The bundled Python script is readable and straightforward, but if you have strict data-handling requirements, inspect or run it in a sandbox before granting access to production data.

Food Channel Skill

Handle messages in a food-tracking channel by logging food intake events.

Configuration

Set the following environment variables or replace placeholders before use:

• FOOD_CHANNEL_ID — Channel ID for food tracking (env var)
• FOOD_PROFILE_PATH — Path to user profile JSON (default: $WORKSPACE/data/food_profile.json)
• Tracker script is at scripts/tracker.py (included in bundle)

Message Types

1. Barcode Lookup

User sends a barcode (numeric string, 8-14 digits). Optional servings specified as "2x", "2 servings", "x2", etc. Defaults to 1.

Flow:

1. Parse the barcode and optional servings from the message
2. Run: python3 scripts/tracker.py lookup <barcode> [servings]
3. If successful, reply with a formatted summary of the food item and nutrition logged
4. If failed, reply with the error

2. Photo Estimate

User sends an image attachment.

Flow:

1. Copy the image to the workspace data dir
2. Resize it to max 1024px on longest side: convert src.jpg -resize '1024x1024>' -quality 80 dst.jpg (or use python3 -c "from PIL import Image; ..." if imagemagick unavailable)
3. Use the image tool on the resized image with a prompt asking to estimate: food items, portion sizes, and approximate nutrition per serving
4. Parse the vision response into structured nutrition data
5. Run: echo '<json>' | python3 scripts/tracker.py estimate
6. Reply with formatted summary noting it's an estimate (≈)

3. Summary Request

User asks for today's summary or a daily summary.

Flow:

1. Run: python3 scripts/tracker.py summary [YYYY-MM-DD]
2. Reply with formatted daily totals

4. Post-Log Check (after every barcode or estimate log)

After logging an entry, check running daily totals against limits:

1. Run: python3 scripts/tracker.py summary
2. Load profile from FOOD_PROFILE_PATH (default: data/food_profile.json)
3. Compare totals against daily_limits. Flag any that are over (or under for fiber_g_min):
   • calories > limit → ⚠️ Over calorie budget ({total}/{limit} kcal)
   • sodium_mg > limit → ⚠️ High sodium ({total}/{limit} mg)
   • sugar_g > limit → ⚠️ Over sugar limit ({total}/{limit} g)
   • fiber_g < limit → ℹ️ Low fiber ({total}/{limit} g)
4. Append any warnings to the log reply. If nothing is over, skip the check section entirely.

Reply Format

For logged items, use this format:

📝 **Item Name** (Brand)
Source: barcode | Servings: 2
Per serving: 150g
---
🔥 300 kcal | 🥩 12g protein | 🍞 45g carbs | 🧈 8g fat
🥬 3g fiber | 🍬 18g sugar | 🧂 420mg sodium
[Vitamins/minerals if present]

For photo estimates, prefix with: 📸 Estimate —

Parsing Servings

From message text, look for patterns like:

• 2x, x2, ×2
• 2 servings, 2 serving
• two, three (common number words)
• If none found, default to 1

Data Access

This skill reads and writes persistent files in the workspace:

• Writes $WORKSPACE/data/food_log.csv — one row per food entry (item, nutrition, timestamps)
• Writes resized images to $WORKSPACE/data/ during photo estimates (cleaned up after processing)
• Reads $WORKSPACE/data/food_profile.json (or FOOD_PROFILE_PATH) — daily nutritional limits
• Network barcode lookups hit https://world.openfoodfacts.org/api/v2/ (public API, no key needed)
• External API photo estimates use the platform image tool which may send images to a remote vision model

Required Files

• scripts/tracker.py — the food tracker script (included in bundle)
• data/food_profile.json — user profile with daily limits (user-created, not included)