Manage your HelloFresh subscription, find and convert recipes to audio, track shipments, and receive delivery notifications via Telegram.

Before installing, consider these points: - The skill will read and store sensitive HelloFresh data (addresses, subscription IDs, payment info, tracking links) under ~/.openclaw/hellofresh — review the code if you are uncomfortable with local storage of this data. - Cloud mode (USE_KERNEL=true) requires a KERNEL_API_KEY; the registry omitted this env var but the code uses it. Cloud mode creates remote browser sessions on kernel.sh that will see your HelloFresh pages — only use it if you trust that service. - Notification features mention Telegram/Discord but the skill does not declare how to supply bot tokens or chat IDs. Verify how notifications are configured and where messages will be sent before enabling notifications. - IMPLEMENTATION_NOTES discusses a Gmail Pub/Sub approach (requiring Gmail API/OAuth). That would require granting email access; although not implemented now, it shows the codebase may expand toward accessing email. Be cautious about granting additional credentials. - If you want to proceed: run the skill in local mode (USE_KERNEL=false) so it uses your local browser context rather than a remote kernel. Inspect handler.ts fully (especially the parts that send notifications or make network calls) and confirm what external endpoints receive your data. Prefer providing explicit environment variables for notification channels and audit those message sinks. If you cannot review the code, treat the skill as higher-risk and avoid enabling cloud mode or any notification automation that might transmit sensitive information.

Type: OpenClaw Skill Name: hellofresh Version: 1.0.0 The skill bundle contains a significant data leak in IMPLEMENTATION_NOTES.md, which includes hardcoded PII such as a specific phone number (+18194482636), subscription IDs, and delivery instructions. Additionally, handler.ts is incomplete and references an undefined function 'checkShipmentAlert', which would cause the agent to fail during notification tasks. While the browser-based automation logic for HelloFresh appears functionally aligned with the description, the inclusion of real-world testing data and incomplete code constitutes a security and stability risk.