pp-myfitnesspal

Pass

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install the CLI tool using npx from the npm registry (@mvanhorn/printing-press) and via go install from a GitHub repository (github.com/mvanhorn/printing-press-library). These sources are consistent with the skill's author context.- [DATA_EXFILTRATION]: The CLI includes a built-in --deliver webhook:<url> functionality. This allows the agent to send the results of food diary exports, nutrient analysis, and user profile data to any external URL provided in the command arguments.- [COMMAND_EXECUTION]: The skill requires the Bash tool to execute the myfitnesspal-pp-cli binary. This tool is used for all core operations, including syncing data, running searches, and performing installation tasks.- [CREDENTIALS_UNSAFE]: The tool relies on a auth login --chrome command to harvest authentication cookies directly from the user's Chrome browser profile to interact with MyFitnessPal, as no official public API is available.
Audit Metadata
Risk Level
SAFE
Analyzed
May 9, 2026, 08:46 PM