Back to skill
Skillv0.1.0
ClawScan security
Ultrahuman Analytics · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewMar 15, 2026, 2:38 PM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's analytics instructions are coherent, but its runtime expectations (an external ultrahuman_mcp tool and an ULTRAHUMAN_EMAIL source) are not declared in the registry metadata, which is an important mismatch to resolve before installing.
- Guidance
- Before installing, verify two things: (1) how the ultrahuman_get_daily_metrics calls are actually performed — does your agent platform provide an ultrahuman_mcp tool and where is its authentication stored? (2) confirm whether the skill expects an ULTRAHUMAN_EMAIL environment variable or will ask the user for an email at runtime; this should be declared in the skill manifest. Because this skill reads sensitive personal health data (sleep, HRV, glucose), ensure you understand where those API requests will be sent, who holds the credentials, whether fetched data will be stored or logged, and that the user consents to pulling multiple days of data. If you plan to install, ask the publisher to update the manifest to declare required tools and any environment variables/credentials (or clarify that the ultrahuman_mcp tool handles auth) so you can assess proportionality and privacy implications.
Review Dimensions
- Purpose & Capability
- concernThe SKILL.md describes appropriate multi-day Ultrahuman analytics and consistently instructs the agent to call an ultrahuman_mcp tool (ultrahuman_get_daily_metrics). However, the skill registry metadata declares no required tools, binaries, or environment variables. The SKILL.md explicitly requires either an ULTRAHUMAN_EMAIL environment variable or the email provided in the user message — this dependency is not reflected in the metadata, which is an inconsistency.
- Instruction Scope
- noteInstructions are narrowly scoped to read-only analytics from per-date ultrahuman_get_daily_metrics calls and specify not inventing data. There are no instructions to read unrelated files or to post data to external endpoints other than the implied ultrahuman_mcp. The notable scope issue is the SKILL.md's reliance on ULTRAHUMAN_EMAIL or a provided email and the external ultrahuman_mcp tool; those runtime inputs are not declared in the skill manifest.
- Install Mechanism
- okNo install spec and no code files are present (instruction-only), so there is no installer download or archive-extract risk.
- Credentials
- concernThe manifest lists no required environment variables, but the instructions refer to ULTRAHUMAN_EMAIL as a possible source for identifying the user account. If the skill needs an email or API keys to fetch personal health data, those credentials/inputs should be declared. The current omission is disproportionate to the skill's declared metadata and obscures what personal identifiers or secrets are needed.
- Persistence & Privilege
- okThe skill does not request always:true and is user-invocable only; it does not appear to require persistent installation or system-wide configuration changes.