Meal Suggester

Quick dinner companion blending taste profiles, inventory tracking, and learning-based recipe rotation. Use to generate ≤25‑minute meals, log ingredients, and build shopping suggestions that respect both your and your partner’s preferences.

This skill appears to be low-risk from a security standpoint (no network calls, no credentials), but it's inconsistent: the docs promise inventory-aware, preference-driven suggestions, automated stock/shopping‑list updates, and learning, while the script only picks a random recipe and appends a history line. Before installing or relying on it: 1) Inspect scripts/suggest-meal.sh yourself (it only writes to files under the skill directory). 2) Treat preferences/ allergy files as local sensitive data since they are stored plaintext in the skill folder. 3) Don’t assume the cron job or automatic inventory updates are installed — you would need to add cron or extend the script to parse user input and update stock/shopping-list. 4) If you want the missing features, ask the maintainer for a clear implementation or modify the script locally; run it in a sandbox or with test files first. If you need stronger assurance that the skill is implemented as described, request a version that actually reads/parses inventory and preferences and includes tests or an explicit cron/install step.

Type: OpenClaw Skill Name: meal-suggester Version: 1.1.0 The skill is classified as suspicious primarily due to the inherent vulnerability risk associated with its core functionality: parsing natural language user input (e.g., "on a utilisé X, Y, Z") to modify local markdown files (`inventory/stock.md`). While the instructions in `SKILL.md` and `README.md` are benign and align with the skill's stated purpose, this mechanism presents a significant prompt injection surface against the AI agent. An attacker could potentially craft malicious input to manipulate files beyond the intended scope or trigger unintended commands if the agent's parsing and execution logic are not robust. Additionally, the skill sets up a daily cron job (`SKILL.md`) for scheduled execution, which, while stated as a feature, represents a persistent execution capability that could be abused if the underlying script were malicious (though in this case, `scripts/suggest-meal.sh` appears benign).