Recipes
v1.0.0CLI for AI agents to find recipes for their humans. Uses TheMealDB API. No auth required.
⭐ 1· 1.5k·4 current·4 all-time
by@jeffaf
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (recipes using TheMealDB) align with requiring bash, curl, and jq to call and parse the API. However, SKILL.md and the Agent Implementation Notes refer to a local wrapper ({skill_folder}/recipes and scripts/recipes) and README shows git clone instructions (github.com/jeffaf/recipes-skill) even though this package contains no scripts/code — mismatch between claimed runtime artifacts and what is actually provided.
Instruction Scope
Instructions direct the agent to run a local CLI wrapper (e.g., ./recipes search ...) but the wrapper and scripts are not included and there is no install step to create them. The instructions themselves only target TheMealDB (no extra env vars or unrelated system paths), but the missing scripts create ambiguity about what will actually execute at runtime.
Install Mechanism
No install specification is provided (lower technical risk). README suggests cloning a GitHub repo as a manual installation step, but that external fetch is not formalized in the skill metadata. The lack of an install spec means the skill, as packaged, won't place any code on disk — yet runtime notes assume code exists.
Credentials
The skill requests no environment variables or credentials, which is proportional for an unauthenticated public-API recipe lookup.
Persistence & Privilege
Skill is not always-enabled and is user-invocable; autonomous invocation is allowed (platform default) but not combined with other high-risk flags. The skill does not request persistent credentials or system-wide config changes.
What to consider before installing
This skill claims to be a thin CLI wrapper around TheMealDB and needs only curl/jq, which is reasonable — but the package as provided contains only README and SKILL.md and does not include the scripts the instructions expect. Before installing or invoking it: (1) ask the publisher to include the actual scripts or add a formal install spec pointing to a verified release (GitHub release URL), (2) if you must clone the referenced repo, inspect the repository code (scripts/recipes and any shell scripts) for unexpected network calls, commands that read system files, or commands that run with elevated privileges, (3) avoid running downloaded scripts as root and do not run code that performs arbitrary remote downloads without review, and (4) prefer a skill package that either contains its code or provides a vetted install URL/release. If the author supplies the missing scripts or a trusted install link, re-evaluate; if not, treat this package as incomplete and avoid executing it.Like a lobster shell, security has layers — review code before you run it.
latestvk97ck4qaxryx997841c1twa2v980jcrm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🍳 Clawdis
Binsbash, curl, jq