Cookidoo

Manage Thermomix/Cookidoo meal planning via tmx-cli. Use for recipe search, weekly meal plan management, shopping list generation, favorites, and recipe details. Trigger when the user mentions Cookidoo, Thermomix, Wochenplan, meal plan, Rezept, recipe, or Einkaufsliste for cooking.

This skill appears to implement a legitimate Cookidoo CLI, but there are inconsistencies you should resolve before installing: 1) The registry metadata declares no required secrets, yet the docs and code accept and store Cookidoo credentials and session cookies (files under the skill directory and ~/.tmx_config.json). Confirm whether the skill will ask for your raw password or use an OAuth browser flow, and prefer OAuth if available. 2) If you provide credentials, expect them (or session tokens) to be written to disk; treat those files as sensitive. 3) If you plan to install from the GitHub repo referenced in the README, review that repository (commit history, issues, maintainer) to ensure you trust the source. 4) If you want to limit risk, run the tool in an isolated environment (container or dedicated account) or avoid supplying your Cookidoo password and use OAuth-only login. Finally, ask the maintainer to update the skill metadata to declare any required env vars or credential storage paths so the security posture is clear.

Type: OpenClaw Skill Name: tmx-cli Version: 0.1.0 The skill bundle is benign. The `tmx_cli.py` script is a pure Python CLI tool that interacts with legitimate Cookidoo and Algolia APIs over HTTPS for meal planning, recipe search, and shopping list management. It stores session cookies and cached data in local JSON files within the skill's directory and user configuration in `~/.tmx_config.json`, which are standard practices for CLI tools. The login process uses `getpass` for secure interactive password input. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or obfuscation. The `SKILL.md` instructions for the AI agent are clear, aligned with the stated purpose, and include positive security instructions like confirming destructive actions, with no signs of prompt injection.