OpenCal

Log meals, check nutrition progress, and manage calorie goals in the OpenCal app — hands-free via your AI agent. Use when the user mentions eating, food, cal...

This skill appears to do what it says: it will use your OpenCal API key to call OpenCal's API (api.opencal.ai) via curl/jq to search foods, log entries, and update goals. Before installing: 1) Only provide your OPENCAL_API_KEY (keep it secret); consider creating a limited/revocable key in the app if available. 2) Confirm whether you need to set OPENCAL_BASE_URL — the SKILL.md examples use that optional env var but it isn't declared in the metadata. 3) Understand the agent can call the skill autonomously when triggered by food-related user messages, so revoke the key if you see unexpected activity. 4) Ensure curl and jq are trusted on the host where the agent runs. If you want stricter limits, ask the skill author to declare OPENCAL_BASE_URL explicitly and to document key scopes and retention.

Type: OpenClaw Skill Name: opencal Version: 1.0.0 The skill is classified as suspicious due to its reliance on direct shell command execution (`curl`, `jq`) for API interactions, which presents a significant vulnerability to shell injection if the AI agent does not rigorously sanitize user input before constructing these commands. Additionally, the `OPENCAL_BASE_URL` override in SKILL.md allows for potential redirection of API calls to arbitrary endpoints if an attacker can control this environment variable via prompt injection. While these capabilities are plausibly needed for the skill's stated purpose, they introduce high-risk attack vectors without clear malicious intent within the skill's instructions themselves.