Photo Calorie Tracker

Photo Calorie Tracker - Recognizes food photos, logs daily calorie intake, and analyzes any date range. Use when: the user sends food images or asks about ca...

This skill appears internally consistent: it analyzes food photos using the platform 'image' tool and reads/writes files in /root/.openclaw/workspace (temp images and per-day memory markdown files). Before installing, consider: (1) it will store and read any images you copy into the temp folder — avoid placing sensitive photos there; (2) the included shell script reads per-day markdown records and expects certain headings (the script searches for Chinese labels), so you may need to adapt record formatting; (3) there are no network calls or credentials requested by the skill, so it doesn't exfiltrate data by design, but you should still confirm you trust the skill source because it will access files in the agent workspace.

Type: OpenClaw Skill Name: photo-calorie-tracker Version: 1.0.0 The skill bundle contains a bash script `scripts/report.sh` that is vulnerable to a limited path traversal. The script accepts a `YEAR` argument (the second positional parameter) without any sanitization and uses it to construct a file path: `FILE="${MEMORY_DIR}/${YEAR}-${DATE}.md"`. An attacker could potentially use this to read files outside the intended directory, although the impact is limited by the appended date suffix. While the instructions in `SKILL.md` are benign and align with the stated purpose of tracking calories, the lack of input validation in the helper script constitutes a vulnerability.