Security audit

FoodLens

Security checks for vulnerabilities and agentic risk

Overview

FoodLens is a coherent meal-photo nutrition tracker, but users should know it sends meal photos to AI vision providers and stores diet logs locally.

Install only if you are comfortable with meal photos being processed by external AI providers and meal history being saved under the skill workspace. Review the actual local Python scripts and virtual environment before use, avoid photos with sensitive background content, and periodically delete or secure stored meal logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: SKILL.md:33
Finding: Meal Photos Are Transferred to Third-Party AI Providers Without Explicit Privacy Controls
Content: View full analysis
30%, trusts the database 3. Appends the meal to `data/YYYY-MM-DD.json` 4. Outputs a formatted nutrition report **Forward the script output directly to the user.** ``` ### Technical Analysis The skill instructs the agent to save each inbound photo to a temporary path and pass it to `analyze_photo.py`, which is described as transmitting the image to GPT-4o Vision or Gemini. The instructions do not require explicit user consent before this third-party transfer and provide no controls for removing image metadata, cropping unrelated content, minimizing transmitted data, or informing the user which provider receives the image. Meal photographs can contain more than food. They may reveal faces, documents, home or workplace interiors, geolocation metadata, or other identifying information. Although the referenced implementation is absent and its precise network behavior cannot be verified, the documented workflow explicitly requires external image processing. ### Attack Path 1. A user submits a meal photograph to the agent. 2. The agent saves the original photograph to a temporary filesystem path. 3. The agent invokes `analyze_photo.py`. 4. According to the documented behavior, the script sends the photograph to GPT-4o Vision or, upon failure, Gemini. ...[truncated 674 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:20
Finding: Sensitive Nutrition and Health-Related Records Are Persisted Without Defined Storage Protections
Content: View full analysis
30%, trusts the database 3. Appends the meal to `data/YYYY-MM-DD.json` 4. Outputs a formatted nutrition report ``` ```python meal = { 'meal_id': f'meal_{uuid.uuid4().hex[:10]}', 'timestamp': datetime.now().isoformat(), 'label': 'lunch', 'items': items, 'meal_total': meal_total, 'health_score': score, 'comment': comment, } day['meals'].append(meal) recalc_day_totals(day) save_day(date_str, day) ``` ```markdown ## Data Layout | Path | Description | |------|-------------| | `data/YYYY-MM-DD.json` | Daily meal logs | | `nutrition_db.py` | 778 foods + 197 aliases | | `analyze_photo.py` | Main entry point | | `foodlens_config.json` | User nutrition goals | | `venv/` | Python virtual environment | ``` ### Technical Analysis The documented workflow persistently records meal items, timestamps, nutrition totals, health scores, comments, and user nutrition goals in date-named JSON files under the skill workspace. These records can form a longitudinal profile of a user's dietary habits and health-related behavior. The skill documentation does not define restrictive file permissions, encryption at rest, authenticated access, retention limits, secure deletion, separation between users, or protecti ...[truncated 1649 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill metadata trigger is broad enough to activate on very common meal-related language, increasing the chance the skill runs when the user did not clearly request nutrition tracking. In this skill’s context, unintended activation can lead to unnecessary processing of meal photos and logging of sensitive diet data, which creates privacy and consent risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions list generic food-related terms without specifying exclusion cases or requiring an explicit analysis request. Because this skill persists meal data to daily logs, accidental activation can cause collection and retention of health-related information from ordinary conversation or image sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow instructs the agent to append meal data to persistent daily JSON files and forward results, but it does not warn the user that nutrition and meal information will be stored. Since dietary data can reveal health patterns and habits, silent persistence undermines informed consent and increases privacy exposure if logs are later accessed or reused.
Content: No source excerpt is available for this finding.