Meal Suggester

• Analyzed: May 12, 2026, 3:40 AM
• Findings: 1
• Version: 1.1.0
• Hash: d42774f94497c00137c5fc57020a197de6bc0382e7da5eb2a6772cb36f6e1e8e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the inherent vulnerability risk associated with its core functionality: parsing natural language user input (e.g., "on a utilisé X, Y, Z") to modify local markdown files (`inventory/stock.md`). While the instructions in `SKILL.md` and `README.md` are benign and align with the skill's stated purpose, this mechanism presents a significant prompt injection surface against the AI agent. An attacker could potentially craft malicious input to manipulate files beyond the intended scope or trigger unintended commands if the agent's parsing and execution logic are not robust. Additionally, the skill sets up a daily cron job (`SKILL.md`) for scheduled execution, which, while stated as a feature, represents a persistent execution capability that could be abused if the underlying script were malicious (though in this case, `scripts/suggest-meal.sh` appears benign).