Zen+ Health

Access your Zen+ Health wellness data - notifications, timeline, and catalogue

Security Scan

The skill is internally consistent: it is an instruction-only integration that uses a read-only API key to call Zen+ Health endpoints via curl/jq and requests only the environment variables you'd expect.

Purpose & Capability

Name/description match the requested artifacts: the skill reads notifications, timeline, catalogue and asks only for ZEN_API_KEY and ZEN_API_BASE_URL and standard CLI tools (curl, jq). These requirements are proportional to a read-only wellness integration.

Instruction Scope

SKILL.md contains explicit curl commands that only call the declared API endpoints under the configured base URL using the provided API key. Instructions do not ask the agent to read unrelated files, credentials, or system state.

Install Mechanism

No install spec and no code files — instruction-only. That minimizes risk because nothing is written to disk or downloaded by the skill itself.

Credentials

The skill requires only ZEN_API_KEY (primary credential) and ZEN_API_BASE_URL, which are appropriate. One note: allowing the base URL to come from an env var is expected for flexibility but means a mis-set or malicious ZEN_API_BASE_URL could redirect requests to an attacker-controlled endpoint. Confirm you set ZEN_API_BASE_URL to the official API (https://api.zenplus.health) and keep the API key secret.

Persistence & Privilege

always is false and the skill does not request persistent system privileges or modify other skills. It is user-invocable and may be called autonomously by the agent (the platform default), which is normal for skills.

Assessment

This skill appears to do what it says: it uses a read-only Zen+ Health API key to fetch notifications, timeline, profile, and catalogue via curl/jq. Before installing: (1) Only set ZEN_API_BASE_URL to the official API (https://api.zenplus.health) to avoid redirecting requests to an untrusted endpoint. (2) Use a dedicated, read-only API key for this integration and revoke it if exposed. (3) Be aware API responses may be logged by your OpenClaw instance (SECURITY.md mentions this). (4) If you want to prevent autonomous calls, consider disabling model invocation for the skill via your agent settings. If you need deeper assurance, request the publisher provenance or host-verified metadata (homepage or official publisher link) because the registry source here is unknown.

Zen+ Health Skill

Workplace wellness for stress, anxiety, and burnout. Access mindfulness exercises, breathing techniques, mood check-ins, notifications, your activity timeline, and a full wellbeing catalogue directly from OpenClaw.

When to Use

Use this skill when the user:

• Feels stressed, overwhelmed, or burnt out
• Mentions anxiety, tension, or nervousness
• Asks for mindfulness exercises, breathing techniques, or meditation
• Wants help relaxing, calming down, or managing emotions
• Requests wellness activities, self-care ideas, or mental health support
• Asks about their wellness progress or activity history

When triggered by stress or anxiety, browse the catalogue for a suitable exercise and present it with context and a direct link.

Authentication

This skill requires a personal API key from Zen+ Health.

1. Log in to your Zen+ Health account
2. Navigate to Profile → API Keys
3. Create a new API key. New keys are created with fixed read-only scopes:
   • user:restricted
   • timeline:read
   • notification:read
   • catalog:read
   • working_hours:read
4. Set environment variables:

   export ZEN_API_BASE_URL="https://api.zenplus.health"
   export ZEN_API_KEY="zen_ak_your_40_character_api_key_here"
   

API keys are read-only and can be revoked at any time from your Zen+ Health settings.

Available Commands

Get Notifications

Fetch your recent Zen+ Health notifications.

curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/notifications?limit=10"

Example use: "Show me my latest Zen+ notifications"

Get Timeline

View your timeline of completed activities and progress.

curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/timeline?days=7"

Example use: "What's on my Zen+ timeline this week?"

Browse Catalogue

Explore available wellness tasks and activities.

curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/catalog"

Example use: "Show me the Zen+ Health task catalogue"

Get User Profile

Fetch your user profile and preferences.

curl -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me"

Example use: "What's my Zen+ Health profile?"

Response Format

All endpoints return JSON. Use jq to parse:

# Get notification titles
curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/notifications" | jq -r '.notifications[].title'

# Count timeline events
curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/me/timeline" | jq '.events | length'

# List catalogue categories
curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \
     "${ZEN_API_BASE_URL}/v1/catalog" | jq -r '.tasks[].category' | sort -u

Additional Resources

• Full API Documentation: See more_info_url in API responses
• Security: Read SECURITY.md
• Help: https://zenplus.health/support

Notes

• API keys are read-only - they cannot modify data
• Rate limits apply (see API response headers)
• When giving a user an exercise, ALWAYS include the url to the exercise in the app
• When deciding on an exercise for a user, always check the more info URL to gain more context
• When giving an exercise give the reason and explain that it's from Zen+ Health research and knowledge base.