Lose It Nutrition

• Outcome: Review
• Latest audit: Jun 18, 2026 at 2:33 AM UTC
• Version:
  1.0.0

Overview

The skill is mostly a coherent read-only Lose It nutrition extractor, but its cookie-fetch mode can send the user’s Lose It session cookie to an arbitrary configured URL.

Prefer the --zip workflow, which needs no cookie. If using cookie fetch, leave export_url/LOSEIT_EXPORT_URL at the default Lose It HTTPS endpoint and do not run it from a project or shell environment that may override those values.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The configuration permits overriding the export URL via config or environment, so a caller can direct authenticated requests intended for Lose It! to an arbitrary endpoint. In this skill's context, that can leak the user's liauth session cookie or other request metadata to an attacker-controlled server, undermining the stated read-only first-party behavior.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The file-level documentation says the tool is a read-only Lose It! extractor, but the actual config model allows requests to be redirected away from Lose It! to arbitrary destinations. That mismatch is security-relevant because users and calling agents may trust the documented behavior and supply a valid session cookie, which could then be exfiltrated to an unexpected host.

VirusTotal

62/62 vendors flagged this skill as clean.