← Back to Skills Marketplace
135
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install normieclaw-health-buddy-pro
Description
Stop spending 10 minutes typing out every ingredient into a clunky food logging app. Health Buddy Pro lets you snap a photo of your meal and get exact calori...
Usage Guidance
Summary of what to check before installing:
- Inspect the SKILL.md and other text files in a viewer that shows hidden characters (e.g., cat -v, a hex editor) to ensure there are no concealed unicode control characters or embedded instructions. The pre-scan flagged such characters.
- Confirm how your agent's 'image' / vision tool processes images: does it run locally, or does it send images to an external API? The skill assumes local processing; if your agent forwards images to a cloud service, health photos could leave your device.
- The repo claims 'local-only' storage, which is true for the default behavior, but a dashboard-kit and Supabase/Postgres schema are included for optional cloud-backed setups. Only enable cloud sync/backups if you understand and trust the remote service and supply credentials consciously.
- Review scripts/health-buddy-init.sh before running. It enforces secure permissions and symlink checks, but its workspace detection is simplistic — run it from the intended workspace root or inspect where it will create files.
- Treat the 'Codex Security Verified' audit as an author-provided statement; if you need stronger assurance, run the skill in a sandboxed environment (or inspect network activity) to confirm it makes no outbound connections.
If any of the above checks raise doubts, prefer running the skill in an isolated/sandbox workspace or decline installation until you can verify hidden characters and the image-processing behavior.
Capability Analysis
Type: OpenClaw Skill
Name: normieclaw-health-buddy-pro
Version: 1.0.3
Health Buddy Pro is a comprehensive health and nutrition tracking skill that demonstrates high-quality documentation and defensive configuration. The `SKILL.md` includes explicit prompt-injection defenses, instructing the AI to treat all image-extracted text and external content as untrusted data. The setup and initialization scripts (`SETUP-PROMPT.md` and `health-buddy-init.sh`) employ security best practices, such as symlink detection to prevent directory traversal and strict file permissions (`chmod 600/700`) to ensure data remains private and local. No indicators of data exfiltration, malicious execution, or unauthorized persistence were found.
Capability Assessment
Purpose & Capability
The skill's name/description, SKILL.md, and included script consistently implement local photo-based meal logging and local storage of logs — no credentials or external services are required by default. However, the repository also contains a dashboard-kit and SQL schema mentioning Supabase/Nollio cloud backends and 'sync' options; that creates an optional cloud integration path that contradicts the README/SECURITY.md's strong 'local-only' claim. The presence of that cloud dashboard material is plausible as an opt-in feature but is worth noting because it increases the potential blast radius if enabled.
Instruction Scope
SKILL.md instructs the agent to use vision tools to extract food items and to read/write local files under data/ (e.g., data/nutrition-log.json). The instructions include robust prompt-injection defenses and explicitly treat extracted text as data not instructions. However, the pre-scan detected prompt-injection patterns (e.g., 'ignore-previous-instructions' and 'unicode-control-chars') inside SKILL.md — while they appear to be present as examples of malicious payloads that should be ignored, their presence increases risk and should be manually inspected to ensure there are no hidden control characters or ambiguous examples that could be mis-parsed. The instructions also rely on the host agent's 'image' tool/vision capability; you should verify how that tool handles images (local vs remote processing).
Install Mechanism
There is no external install spec and the only executable is a small shell initializer (scripts/health-buddy-init.sh) that creates local data/config directories with secure permissions and refuses symlinked targets. The shell script appears to avoid writing outside the skill directory, but its workspace-root detection loop is trivial (effectively uses current directory) — meaning if run from an unexpected working directory it will create/operate under that cwd's skills/ path. No downloads, no external URLs, and no packages are installed by the skill itself.
Credentials
The skill requests no environment variables, no credentials, and no config paths beyond its own skill directory. That is proportionate to a local meal-logging skill. The only notable point is the repository's documentation for optional cloud/back-end usage (Supabase) which would require credentials if the user elects to enable it; those credentials are not required by default.
Persistence & Privilege
The skill does create and write to local files under skills/health-buddy-pro/data, which is expected for a logging tool. It does not request always:true, does not require elevated system privileges, and contains checks rejecting symlinked paths to prevent writes escaping the skill directory. It does not modify other skills' configurations in the provided files.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install normieclaw-health-buddy-pro - After installation, invoke the skill by name or use
/normieclaw-health-buddy-pro - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.3
v1.0.3: Security fixes: confined scripts to skill directory, removed filesystem traversal from setup
v1.0.2
v1.0.2: MIT license, cleaned descriptions, removed cross-sell
v1.0.0
Initial publish from NormieClaw.ai — Free OpenClaw skills for everyone.
Metadata
Frequently Asked Questions
What is Health Buddy Pro?
Stop spending 10 minutes typing out every ingredient into a clunky food logging app. Health Buddy Pro lets you snap a photo of your meal and get exact calori... It is an AI Agent Skill for Claude Code / OpenClaw, with 135 downloads so far.
How do I install Health Buddy Pro?
Run "/install normieclaw-health-buddy-pro" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Health Buddy Pro free?
Yes, Health Buddy Pro is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Health Buddy Pro support?
Health Buddy Pro is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Health Buddy Pro?
It is built and maintained by Nollio (@nollio); the current version is v1.0.3.
More Skills