Mealplan

Plan meals with calorie tracking and shopping lists. Use when organizing weekly meals.

This skill appears coherent and local-only, but review and consider these practical points before installing: (1) it stores all data under ~/.local/share/mealplan — sensitive meal notes will be stored in plain files; (2) the shell script builds JSON by echoing raw user input without escaping and uses unquoted variables in places (grep and data writes), which can cause malformed records or unexpected behavior if you pass unusual characters — this is a robustness/data-integrity issue, not evidence of exfiltration; (3) if you want extra safety, inspect or run the script in a sandbox, or modify it to properly escape/quote inputs and validate arguments before use.

Type: OpenClaw Skill Name: mealplan Version: 3.0.0 The script `scripts/script.sh` contains a shell injection vulnerability in the `cmd_add` function, where user-provided arguments are concatenated into an `echo` command without proper quoting or sanitization. While the skill's functionality is consistent with its stated purpose of meal planning, this flaw allows for arbitrary command execution if the agent passes maliciously crafted input to the script.