Diet Tracker

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:50 AM UTC
• Version: 1.2.0

Overview

The skill performs diet tracking, but logging a meal can also copy private diet records into an Obsidian vault and push repository contents to GitHub without clear user-facing consent.

Review before installing. Use this skill only if you are comfortable with diet logs and possibly other Obsidian vault changes being committed and pushed to the configured GitHub remote using existing local credentials. A safer version would default to local-only storage, disclose the USDA endpoint and all storage locations, and require explicit opt-in before any Obsidian or GitHub sync.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

date_str = now.strftime("%Y-%m-%d")
            
            # Git add, commit, push
            subprocess.run(["git", "-C", obsidian_dir, "add", "-A"], check=True, capture_output=True)
            subprocess.run(["git", "-C", obsidian_dir, "commit", "-m", f"Update diet log for {date_str}", "--allow-empty"], check=False, capture_output=True)
            result = subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True, text=True)
            if result.returncode == 0:

• Confidence: 88% confidence
• Finding: subprocess.run(["git", "-C", obsidian_dir, "add", "-A"], check=True, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Git add, commit, push
            subprocess.run(["git", "-C", obsidian_dir, "add", "-A"], check=True, capture_output=True)
            subprocess.run(["git", "-C", obsidian_dir, "commit", "-m", f"Update diet log for {date_str}", "--allow-empty"], check=False, capture_output=True)
            result = subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True, text=True)
            if result.returncode == 0:
                print(f"✅ 已推送到 GitHub")

• Confidence: 90% confidence
• Finding: subprocess.run(["git", "-C", obsidian_dir, "commit", "-m", f"Update diet log for {date_str}", "--allow-empty"], check=False, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Git add, commit, push
            subprocess.run(["git", "-C", obsidian_dir, "add", "-A"], check=True, capture_output=True)
            subprocess.run(["git", "-C", obsidian_dir, "commit", "-m", f"Update diet log for {date_str}", "--allow-empty"], check=False, capture_output=True)
            result = subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True, text=True)
            if result.returncode == 0:
                print(f"✅ 已推送到 GitHub")
            else:

• Confidence: 97% confidence
• Finding: result = subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"✅ 已推送到 GitHub")
            else:
                # Try pull and push again
                subprocess.run(["git", "-C", obsidian_dir, "pull", "origin", "master", "--rebase"], check=False, capture_output=True)
                subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True)
                print(f"✅ 已推送到 GitHub (after rebase)")
        except Exception as e:

• Confidence: 86% confidence
• Finding: subprocess.run(["git", "-C", obsidian_dir, "pull", "origin", "master", "--rebase"], check=False, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
                # Try pull and push again
                subprocess.run(["git", "-C", obsidian_dir, "pull", "origin", "master", "--rebase"], check=False, capture_output=True)
                subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True)
                print(f"✅ 已推送到 GitHub (after rebase)")
        except Exception as e:
            print(f"⚠️ GitHub 推送失败: {e}")

• Confidence: 95% confidence
• Finding: subprocess.run(["git", "-C", obsidian_dir, "push", "origin", "master"], check=False, capture_output=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its documented behavior implies file reads, file writes, network access, and shell execution. This creates a transparency and governance gap: the agent may access sensitive profile data, persist logs, and invoke external commands without clear user or platform review, which is especially risky for health-related personal data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The described purpose understates significant behaviors: reading personal profile data, contacting an external nutrition service, copying logs into another storage system, and running git commands that may sync data to GitHub. This mismatch can cause users and reviewers to consent to a simple diet logger while the skill actually processes and exports sensitive health data, increasing the risk of privacy leakage and unintended data publication.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill reads detailed personal health/profile data from a global /root/clawd/USER.md file, including height, weight, age, gender, activity level, and macro targets. Accessing unrelated global profile data broadens data exposure beyond the minimum needed for the immediate action and creates unnecessary sensitivity risk if the file contains more personal information than expected.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The code performs external USDA API lookups, but the skill metadata does not disclose that meal queries may be sent to a third-party service. Undisclosed network transmission creates a privacy and trust risk because users may assume meal data stays local within a diet-tracking skill.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code synchronizes diet logs to an Obsidian vault and pushes them to GitHub, which is materially beyond the stated diet-tracking/reminder behavior. This mismatch hides a data-sharing capability that can expose sensitive health-related information to broader systems and remote services.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Executing git commands is not necessary for core diet logging and introduces file staging, history creation, and remote network transmission capabilities. In this skill context, that unjustified power significantly increases the blast radius from simple note-taking to potential data exfiltration.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: A broad activation description can cause the skill to trigger on general diet or food discussions rather than explicit logging or nutrition requests. In this skill, unintended activation is more dangerous because it may read USER.md, write daily logs, and perform network lookups on sensitive health-related content without the user clearly intending those actions.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The listed trigger phrases such as logging meals or checking diet progress are generic enough to match casual conversation. Because the skill has write and network-related side effects, ambiguous triggers can lead to unwanted logging, profile access, or external queries based on ordinary discussion rather than informed user intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill does not prominently warn users that it reads profile data, writes dated diet logs, and uses online nutrition lookups. For a health-tracking skill, this omission weakens informed consent and can expose sensitive dietary and biometric information to local storage and external services without the user realizing it.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script not only reads sensitive health-related data from USER.md but also prints parsed values such as height, weight, age, gender, activity level, and macro targets to stdout. Debug logging of health/profile data can expose sensitive information in logs, terminals, or monitoring systems not intended for personal data storage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill sends the user's food query to an external USDA API without explicit disclosure or consent. Even if a food name seems low sensitivity, meal queries can reveal diet habits, religious practices, allergies, medical conditions, or weight-loss efforts when linked to a user.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script pushes diet log contents to GitHub without any explicit privacy warning, consent flow, or indication of repository visibility. Because diet logs may contain sensitive health and routine information, undisclosed publication to a third-party service creates a substantial privacy and confidentiality risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Fallback to API
    try:
        # Use Nutrition API to get nutrition information
        api_url = f"https://api.nal.usda.gov/fdc/v1/food/search?api_key=DEMO_KEY&query={food_item}"
        response = requests.get(api_url)
        response.raise_for_status()
        data = response.json()

• Confidence: 94% confidence
• Finding: https://api.nal.usda.gov/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.