Is Juggernaut0825/bulkcut-coach safe?
https://github.com/Juggernaut0825/bulkcut-coach
This appears to be a legitimate fitness and diet tracking tool that uses AI for food photo analysis and workout logging. The primary security concern is that it instructs the agent to execute Python code via bash commands, which grants elevated privileges that could theoretically be abused despite being used for legitimate purposes.
Category Scores
Findings (4)
MEDIUM Python Code Execution via Bash -30 ▶
The SKILL.md instructs the agent to execute Python code directly via bash commands. While the code appears to implement legitimate fitness tracking functionality, this grants significant execution privileges that could potentially be abused if the skill were compromised or combined with malicious input.
LOW External API Integration -15 ▶
The skill makes HTTP requests to OpenRouter AI service (openrouter.ai) for food photo analysis. While legitimate for the stated purpose, this creates an external dependency and sends user data to a third-party service.
LOW Elevated Privilege Combination -30 ▶
The combination of Python code execution capabilities and external API access creates elevated privileges that, while used legitimately for fitness tracking, could potentially be misused in adverse scenarios.
INFO Environment File Access -5 ▶
The skill loads .env files to access OpenRouter API keys, which is standard practice but was detected by monitoring systems.