Pantry Tracker

Track grocery purchases and monitor food freshness using Supabase. Use when monitoring grocery orders, checking what food is expiring, logging pantry items,...

Security Scan

The skill's requirements, instructions, and code are consistent with a Supabase-backed pantry tracker and do not request disproportionate access or perform unexpected network/file exfiltration.

Purpose & Capability

Name/description (track groceries + freshness) align with the code and SKILL.md. The only runtime requirements are SUPABASE_URL and SUPABASE_KEY, which are appropriate for a Supabase-backed CLI. No unrelated credentials or binaries are requested.

Instruction Scope

SKILL.md instructs the agent to use an existing email skill to parse grocery emails, produce JSON, and call the included CLI. The skill itself does not access email or other system areas. CLI commands and cron guidance match the script's implemented behavior.

Install Mechanism

No install spec — instruction-only with a single Python script. Nothing is downloaded or installed automatically, which minimizes risk.

Credentials

Only SUPABASE_URL and SUPABASE_KEY (anon key) are required and the code uses only those env vars. The SKILL.md explicitly warns not to use the service-role key. Environment access is proportional to the stated purpose.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges or modify other skills. It runs as a normal, user-invoked/autonomous-capable skill.

Assessment

This skill appears coherent and limited to operating a Supabase-backed pantry. Before installing: (1) ensure you provide only the Supabase anon key (not the service_role key) and confirm your Supabase project enforces Row Level Security (RLS) or otherwise restricts access for that anon key; anon keys can still expose data if RLS/policies are misconfigured. (2) Verify that the email parsing is performed by your agent's separate email skill and that you do not accidentally provide email credentials to this skill. (3) Review the provided SQL schema in your own Supabase project and run it there (do not point the skill at a production DB you don't control). (4) Note the registry summary shows a malformed env listing ([object Object])—double-check the platform's install UI shows the two required env vars. (5) If you operate this in a multi-user environment, add RLS policies so anon keys can only access that user's items. Other than these standard cautions, the skill's behavior and resource needs are consistent with its description.

Track grocery items from purchase to plate (or trash). Parses grocery order emails, stores items in Supabase with estimated expiry dates, and sends daily summaries of what needs eating.

Setup

1. Supabase

Create a Supabase project and run the schema in references/supabase-schema.sql in the SQL editor.

Store credentials as env vars:

SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your-anon-key

Use the anon key (not the service role key). The anon key is safe for client-side use and sufficient for all pantry operations. Never use the service role key — it bypasses Row Level Security.

2. Cron Jobs

Set up two cron jobs in OpenClaw:

Email scanner (every 2-4 hours): Use the agent's existing email tool (e.g. gog for Gmail, or whatever email skill is installed) to search for grocery order confirmations. This skill does NOT access email directly — the agent reads email through its own authenticated tools, then passes parsed items to the pantry CLI.

Search email for recent grocery orders (Whole Foods, Instacart, Amazon Fresh, Costco, Walmart). Parse item names and quantities. For each item, look up shelf life in references/shelf-life.md and calculate expires_at from today. Write items to a JSON array and run: python3 scripts/pantry.py bulk-add /tmp/pantry-items.json

Morning summary (daily, e.g. 7am):

Run: python3 scripts/pantry.py summary
If output is not "PANTRY_OK", send the summary to the user.

CLI Reference

All commands: python3 scripts/pantry.py <command>

Command	Description
add <name> -c <category> -q <qty> -e <days>	Add single item
bulk-add <file.json>	Add items from JSON (email parse output)
expiring [--days N]	Show items expiring within N days (default 3)
status	Full pantry overview by category
use <name>	Mark item as used
toss <name>	Mark item as tossed/wasted
refresh	Auto-update statuses (fresh → use-soon → expired)
summary	Morning summary for cron (outputs PANTRY_OK if nothing urgent)

Bulk-add JSON format

[
  {
    "name": "Strawberries",
    "category": "produce",
    "quantity": "1 lb",
    "expires_days": 5,
    "source": "whole-foods",
    "order_id": "111-1234567"
  }
]

Email Parsing Guide

When scanning grocery emails, extract:

1. Item name — normalize to common name (e.g., "Org Strawberries 1lb" → "Strawberries")
2. Quantity — preserve as-is from email ("2 lbs", "1 bunch", "6 ct")
3. Category — assign: produce, dairy, meat, bakery, pantry, frozen, other
4. Shelf life — look up in references/shelf-life.md. If not listed, estimate conservatively.
5. Source — which store (whole-foods, instacart, costco, etc.)

Supported email patterns

• Whole Foods / Amazon Fresh: Subject contains "Your delivery" or "order delivered"
• Instacart: Subject contains "delivery complete" or "order receipt"
• Costco: Subject contains "order confirmation"
• Walmart: Subject contains "delivery confirmed"

Search email for these patterns. Parse the item list from the email body. When in doubt about an item's category or shelf life, use conservative estimates.

Manual Usage

Users can also say things like:

• "Add chicken breast to the pantry, expires in 2 days"
• "What's expiring soon?"
• "Mark the strawberries as used"
• "I tossed the leftover salmon"
• "What's in my pantry right now?"

Map these to the appropriate CLI commands.