pp-myfitnesspal
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to install the CLI tool using
npxfrom the npm registry (@mvanhorn/printing-press) and viago installfrom a GitHub repository (github.com/mvanhorn/printing-press-library). These sources are consistent with the skill's author context.- [DATA_EXFILTRATION]: The CLI includes a built-in--deliver webhook:<url>functionality. This allows the agent to send the results of food diary exports, nutrient analysis, and user profile data to any external URL provided in the command arguments.- [COMMAND_EXECUTION]: The skill requires theBashtool to execute themyfitnesspal-pp-clibinary. This tool is used for all core operations, including syncing data, running searches, and performing installation tasks.- [CREDENTIALS_UNSAFE]: The tool relies on aauth login --chromecommand to harvest authentication cookies directly from the user's Chrome browser profile to interact with MyFitnessPal, as no official public API is available.
Audit Metadata