Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FoodLens

v1.0.0

AI-powered meal photo recognition and nutrition tracking. Use when a user sends a food/meal photo with keywords like breakfast, lunch, dinner, snack, or "wha...

0· 111·0 current·0 all-time
byKarl Yang@yxjsxy

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yxjsxy/foodlens.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "FoodLens" (yxjsxy/foodlens) from ClawHub.
Skill page: https://clawhub.ai/yxjsxy/foodlens
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install foodlens

ClawHub CLI

Package manager switcher

npx clawhub@latest install foodlens
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (meal-photo recognition, nutrition tracking) match the actions described: saving photos, running analyze_photo.py, consulting a local nutrition_db, appending JSON logs, and producing summaries. No unrelated credentials, binaries, or services are requested.
Instruction Scope
Instructions explicitly instruct the agent to save photos, activate a virtualenv, run local Python scripts (analyze_photo.py) and import from a local module (foodlens), then write JSON logs under a user directory. This is expected for a local tracker, but it means the skill will execute arbitrary Python code present in $FOODLENS_DIR and will read/write files there. Also the fallback uses an 'image' tool / GPT-4o Vision which will send image data to external model providers.
Install Mechanism
No install spec or third-party downloads are present (instruction-only). That reduces supply-chain risk, but it requires the user to supply the code, venv, and dependencies. The skill assumes local project files exist; nothing is downloaded automatically.
Credentials
The skill declares no required environment variables, credentials, or config paths beyond optional defaults for $FOODLENS_DIR and venv. The only notable external interaction is use of LLM vision/image tools (model/provider usage), which is consistent with image analysis but has privacy implications.
Persistence & Privilege
always:false (no forced global inclusion). The skill writes persistent data (data/YYYY-MM-DD.json) and expects a venv and local files under the specified workspace directory. Writing user-local logs is coherent for the purpose but grants the skill filesystem persistence within that directory.
Assessment
This skill appears to do what it says, but it runs local Python code and sends images to LLM vision tools. Before installing or invoking: (1) Inspect the contents of $FOODLENS_DIR (especially analyze_photo.py, nutrition_db.py, and any activation scripts) to ensure they are safe and from a trusted source; (2) Run the code in an isolated environment (dedicated venv or container); (3) Be aware that images will be sent to external model providers (privacy risk) — avoid sending sensitive photos; (4) Back up any data you care about before letting the skill write to data/YYYY-MM-DD.json; (5) If you don’t already have the project code, obtain it from a trustworthy source rather than relying on this instruction-only skill to function automatically.

Like a lobster shell, security has layers — review code before you run it.

latestvk9739pz3m1g437f2h9zvqb9wq983k2m3
111downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

FoodLens — AI Meal Photo & Nutrition Tracker

Trigger Conditions

User sends a meal/food photo with context such as:

  • breakfast / lunch / dinner / snack / supper / 早饭 / 午饭 / 晚饭 / 加餐 / 零食

Configuration

Set these paths for your deployment (defaults shown):

FOODLENS_DIR=~/.openclaw/workspace/skills/foodlens
FOODLENS_DATA=$FOODLENS_DIR/data          # daily JSON logs: YYYY-MM-DD.json
FOODLENS_VENV=$FOODLENS_DIR/venv

Nutrition goals are user-configurable. Defaults (edit foodlens_config.json):

  • Calories: 2000 kcal/day
  • Protein: 80g | Carbs: 250g | Fat: 65g

Core Flow

Step 1 — Analyze Photo (Primary)

Save the inbound photo to a temp path, then run:

cd $FOODLENS_DIR && source venv/bin/activate
python3 analyze_photo.py /path/to/photo.jpg "lunch"

This script:

  1. Calls GPT-4o Vision (fallback: Gemini) to identify foods and estimate portion sizes using container/utensil references
  2. Cross-validates against nutrition_db (778 foods + 197 aliases); if deviation > 30%, trusts the database
  3. Appends the meal to data/YYYY-MM-DD.json
  4. Outputs a formatted nutrition report

Forward the script output directly to the user.


Step 2 — Fallback (API unavailable)

If analyze_photo.py fails, use the image tool:

image(
  image="/path/to/photo.jpg",
  prompt="You are a professional nutritionist. Identify all foods in this meal
  photo. Observe container size and utensils to estimate actual grams per item.
  Reference: standard takeout box 500–800 ml, bowl of rice ~150–200 g,
  stir-fried noodles ~400–500 g. List each food: name, estimated grams,
  kcal per 100 g, protein/carb/fat per 100 g."
)

Then write results via Python:

cd $FOODLENS_DIR && source venv/bin/activate && python3 - <<'EOF'
import json, uuid, sys
sys.path.insert(0, '.')
from foodlens import (ensure_item_nutrition, calc_total,
                      health_score_and_comment, load_day, save_day,
                      today_str, recalc_day_totals)
from datetime import datetime

date_str = today_str()
day = load_day(date_str)

# Replace with image tool results
items = [
    ensure_item_nutrition({'name': 'food name', 'grams': 300, 'source': 'image_tool'}),
]

meal_total = calc_total(items)
score, comment = health_score_and_comment(meal_total, len(items))
meal = {
    'meal_id': f'meal_{uuid.uuid4().hex[:10]}',
    'timestamp': datetime.now().isoformat(),
    'label': 'lunch',
    'items': items,
    'meal_total': meal_total,
    'health_score': score,
    'comment': comment,
}
day['meals'].append(meal)
recalc_day_totals(day)
save_day(date_str, day)
print(json.dumps({'meal': meal, 'daily_total': day['daily_total']}, ensure_ascii=False, indent=2))
EOF

Step 3 — Format Reply

🍽️ [Lunch] Nutrition Analysis

🔍 Identified foods:
  • Stir-fried noodles ~400g (720 kcal)
  • Shrimp ~30g (27 kcal)
  • Chicken slices ~60g (90 kcal)

📊 Meal total:
  • Calories: 837 kcal
  • Protein: 38g | Carbs: 102g | Fat: 29g

⭐ Health score: 7/10
  Comment: ...

📈 Daily total (meal N):
  • Calories: X / [goal] kcal (X%)
  • Protein: X / [goal]g (X%)

Step 4 — User Corrections

If user says "that's not X it's Y" or "only about Xg":

  1. Re-query nutrition_db for the corrected food
  2. Update the JSON entry
  3. Reply with corrected nutrition totals

Step 5 — Duplicate Detection

If the same photo is sent again, alert the user it was already logged and ask whether to record again.


Summaries

Daily summary:

cd $FOODLENS_DIR && source venv/bin/activate
python3 analyze_photo.py --summary today

Weekly trend (last 7 days):

cd $FOODLENS_DIR && source venv/bin/activate
python3 analyze_photo.py --weekly-summary yesterday 7

Data Layout

PathDescription
data/YYYY-MM-DD.jsonDaily meal logs
nutrition_db.py778 foods + 197 aliases
analyze_photo.pyMain entry point
foodlens_config.jsonUser nutrition goals
venv/Python virtual environment

Comments

Loading comments...