Diet Tracker

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 1.2.0
• Hash: 6069e902c8deaaa4a7e9a331a61f0cdc6b50ea242c85ca837d8bca764fb0b7e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the use of `subprocess.run` in `scripts/update_memory.py` to execute `git` commands. These commands interact with a local Git repository (`/root/clawd/obsidian-vault`) and push user diet logs to an external GitHub remote. While the stated purpose is benign (data synchronization), this capability is high-risk as it involves external network communication and could be abused for data exfiltration if the Git remote were compromised or misconfigured. Additionally, `scripts/get_food_nutrition.py` makes external API calls to `https://api.nal.usda.gov/fdc/v1/food/search` for nutrition data, which is a network capability, though to a legitimate service using a demo key.