Feast - Intelligent meal planning, region and season aware shopping lists, respects dietary requirements, provides recipes, and generates immersive mealtime playlists

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:06 AM UTC
• Version: 1.0.2

Overview

Feast is a coherent meal-planning skill, but its recurring background reminders and optional external notification delivery need review before installing.

Review Feast's notification setup before installing. Use webchat/local delivery or disable push unless you intentionally want Telegram, Discord, Signal, Pushbullet, or ntfy reminders. Avoid storing unnecessary sensitive health or household details, and remove the Feast cron jobs if you stop using the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions direct execution of an external Python script during notification delivery, effectively introducing code execution and dependency trust into a meal-planning workflow. If the script path, skill contents, or profile-controlled arguments are tampered with, this could enable arbitrary command execution, data exfiltration, or abuse of local credentials and external notification accounts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly instructs reading and writing user workspace files, but it does not declare an explicit tool scope or permissions boundary. That creates ambiguity about what filesystem access the agent may use, increasing the risk of overbroad file access or unauthorized modification of user data if the runtime grants more capability than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill routes reminders and optional push notifications through third-party services like Telegram, Discord, Signal, Pushbullet, and ntfy, but it does not prominently warn users that meal plans, schedules, preferences, or dietary information may leave the local workspace. This is a privacy issue because even seemingly harmless food data can reveal routines, health-related preferences, location, and household patterns to external providers.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

- "Turn off morning hints"
- "Enable Pushbullet notifications"

When updating, remove old cron jobs using stored IDs and create new ones with updated settings.

## Workflows

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The specification collects sensitive profile data including location, dietary restrictions/allergies, household patterns, budget, store preferences, and timezone, but it does not describe any privacy notice, retention limits, consent flow, or guidance on minimizing collection. In a meal-planning context this data is not inherently dangerous by itself, but it becomes sensitive when persisted in workspace files and combined over time, creating avoidable privacy and profiling risk if exposed to other skills, logs, backups, or operators.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The notification design routes meal-plan content through third-party channels such as Telegram, Discord, Signal, Pushbullet, and ntfy without requiring an explicit warning that user data will leave the local OpenClaw environment. Because notifications may include schedule, dietary, shopping, and behavioral details, this can disclose personal information to external services, device notifications, or misconfigured public topics, especially for ntfy if topic naming is weak or server choice is unsafe.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding flow expands beyond meal planning into cross-channel messaging and notification orchestration, including Telegram, Discord, Signal, push notifications, and cron-driven agent turns. That creates unnecessary data flows and automation side effects for a cooking skill, increasing the attack surface for unauthorized messaging, spam, privacy leakage, and abuse of external integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill collects potentially sensitive personal data such as location, dietary restrictions, religious food constraints, schedule preferences, and preferred communication channels, then uses that data to drive follow-on messaging. Without a clear warning that this information will be stored and used for recurring notifications, users cannot meaningfully consent to the collection and secondary use of their data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions direct persistent creation of profile and history files in the workspace without clearly telling the user that their personal preferences and meal-related data will be saved long-term. Hidden persistence increases privacy risk, especially because the stored data can include household details, dietary restrictions, schedules, and messaging preferences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly documents that persistent user meal data is stored in the workspace, including profile, history, favourites, failures, and weekly plans, but it does not warn users about retention, visibility, or sensitivity of that data. While this is not an active exploit by itself, it is a genuine privacy and security weakness because users may unknowingly store dietary preferences, routines, and household information in persistent agent-managed files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.