Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

hash health

v1.0.9

Hash Health — personal nutrition tracking, meal logging, medication management, and daily health dashboard. Use when user mentions food, meals, eating, loggi...

0· 128·0 current·0 all-time
byC.K.DEVAK@devak208

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for devak208/hash-health.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "hash health" (devak208/hash-health) from ClawHub.
Skill page: https://clawhub.ai/devak208/hash-health
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: HASH_HEALTH_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install hash-health

ClawHub CLI

Package manager switcher

npx clawhub@latest install hash-health
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description (nutrition, meal logging, medication management) align with needing an API token (HASH_HEALTH_TOKEN). However, all API calls are directed to https://hash-claude-mcp.vercel.app, which is not obviously an official Hash Health API domain. The skill claims "All data is sent to the user's own Hash Health account. No data goes to third parties," but the documented endpoint suggests the token and user data will be sent to that third-party host — this inconsistency is unexplained and concerning.
!
Instruction Scope
Runtime instructions require the agent to immediately upload user images ("Call hash_upload_image immediately" and "do NOT describe or ask first") and to call analysis endpoints without prior user confirmation for text triggers. That means the skill will forward potentially sensitive images and meal descriptions to the configured endpoint automatically. The instructions also ask to include detailed visual analysis in requests, increasing the amount of personal data transmitted.
Install Mechanism
No install spec and no code files — instruction-only skill. Nothing is written to disk or installed by the skill itself, which minimizes installation risk.
Credentials
The skill requests a single API credential (HASH_HEALTH_TOKEN), which is reasonable for a service-integration skill. The proportionality concern arises because that token will be used in Authorization headers sent to the documented third-party endpoint; confirm that this endpoint is an official Hash Health host before supplying sensitive credentials.
Persistence & Privilege
always:false (not force-included) and no install actions. The skill can be invoked autonomously (platform default). Combined with the auto-upload instructions, autonomous invocation could cause unprompted transmission of images/text to the external endpoint — consider this when granting agent autonomy.
What to consider before installing
Before installing, verify that https://hash-claude-mcp.vercel.app is an official Hash Health API endpoint or trusted proxy. Key points to consider: - The skill will send your HASH_HEALTH_TOKEN as a Bearer token to that domain and auto-upload images/text without asking — if the domain is not trusted, your account access and personal data could be exposed. - Ask the publisher: why use that domain instead of an official Hash Health API? Request documentation or a privacy/security policy. - If you proceed, consider using a restricted or test API key (not your primary account key) and be prepared to rotate/revoke it if anything looks suspicious. - If you need the skill to prompt before uploading images or before sending sensitive data, ask the developer to modify SKILL.md to require explicit user confirmation prior to any upload. Given the unresolved mismatch between the "no third parties" claim and the explicit third-party endpoint, treat this skill as potentially risky until you confirm the endpoint's trustworthiness.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🥗 Clawdis
EnvHASH_HEALTH_TOKEN
Primary envHASH_HEALTH_TOKEN
latestvk9731mdjmkvyn81xhcxj6fpjdx841xea
128downloads
0stars
10versions
Updated 3w ago
v1.0.9
MIT-0

You are connected to Hash Health, a personal nutrition and health tracking platform.

All data is sent to the user's own Hash Health account. No data goes to third parties.


CRITICAL RULES

Food image received (user sends a photo):

  1. Call hash_upload_image immediately with the image — do NOT describe or ask first
  2. Call detectIngredients with your visual analysis as text parameters
  3. Show detected ingredients from the tool result — ask "Confirm to save, or edit?"
  4. After user confirms → call analyze_food with image_path from step 1

Food text received ("I ate X", "log X", "save X"):

  • Call hash_analyze_and_log immediately — no asking first

Only pause point: After detectIngredients returns, show the list and wait for "yes/save/looks good" before calling analyze_food.

Never:

  • Describe the food or give your own nutrition estimates before calling tools
  • Ask "shall I log this?" before calling tools
  • Call analyze_food before user confirms ingredients
  • Save a meal unless user explicitly says save/log/track

Auth check

Before any request call hash_get_daily_nutrition with no arguments. If auth error → tell user:

"Set your HASH_HEALTH_TOKEN in OpenClaw settings. Get it from Hash Health app → Settings → Advanced → Generate API Key."


Setup

POST https://hash-claude-mcp.vercel.app/api/mcp
Authorization: Bearer $HASH_HEALTH_TOKEN
Content-Type: application/json
Accept: application/json, text/event-stream

All calls use JSON-RPC:

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": { "name": "<tool_name>", "arguments": { ... } },
  "id": 1
}

Result is always in response.result.content[0].text


Log a meal — from image

Step 1 — Upload the image immediately (no text to user first)

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_upload_image",
    "arguments": {
      "image_url": "<attachment URL if available>",
      "image_data_url": "<data:image/jpeg;base64,... if available>",
      "mime_type": "image/jpeg"
    }
  },
  "id": 1
}

Provide exactly ONE of: image_url, image_data_url, or image_base64. Save the path from the response — you will pass it to analyze_food later.

Step 2 — Call detectIngredients with your visual analysis

Pack everything you see in the image into the parameters. Pass ALL ingredients — if you pass a vague list you get a generic result.

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "detectIngredients",
    "arguments": {
      "food_name": "<dish name you identified>",
      "ingredients_list": [
        "rice ~200g",
        "egg ~50g",
        "onion ~30g",
        "oil ~10g"
      ],
      "portion_size": "<total estimated weight e.g. 290g>",
      "visual_notes": "<brief description e.g. fried rice in a bowl>"
    }
  },
  "id": 2
}

Step 3 — Show result and ask for confirmation

Display the ingredient list from the tool result verbatim, then ask:

"Detected: Egg Fried Rice

  1. Rice (~200g)
  2. Egg (~50g)
  3. Onion (~30g)
  4. Oil (~10g) ✅ Confirm to save, or tell me what to add/edit/remove?"

Step 4 — Wait for confirmation, then call analyze_food

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "analyze_food",
    "arguments": {
      "food_name": "<dish name>",
      "selected_ingredients": ["rice", "egg", "onion", "oil"],
      "ingredient_sizes_g": {
        "rice": "200g",
        "egg": "50g",
        "onion": "30g",
        "oil": "10g"
      },
      "is_customized_ingredients": true,
      "save_to_history": true,
      "image_path": "<path from hash_upload_image step>"
    }
  },
  "id": 3
}

Show: dish name, calories, protein, carbs, fat. Confirm saved ✅

Important: selected_ingredients is an array of names. ingredient_sizes_g is an object mapping name → gram string. Never use ingredients_list in analyze_food.


Log a meal — from text

Trigger: "log X", "I ate X", "save X", "track X" — call immediately, no asking.

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_analyze_and_log",
    "arguments": {
      "food_name": "<dish name and description>",
      "save": true,
      "language": "en"
    }
  },
  "id": 1
}

Show: dish name, calories, protein, carbs, fat. Confirm saved.


Check today's nutrition

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_get_daily_nutrition",
    "arguments": { "date": "<YYYY-MM-DD or omit for today>" }
  },
  "id": 1
}

Display: calories, protein (g), carbs (g), fat (g), fiber (g), streak.


Daily dashboard

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_daily_dashboard",
    "arguments": { "date": "<YYYY-MM-DD or omit>" }
  },
  "id": 1
}

View meal history

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_get_meal_history",
    "arguments": {
      "limit": 10,
      "date": "<YYYY-MM-DD or omit for today>"
    }
  },
  "id": 1
}

JSON.parse the analysis field — see Parsing meal analysis data below.


Delete a meal

Step 1 — get meal ID:

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": { "name": "hash_get_meal_history", "arguments": { "limit": 20 } },
  "id": 1
}

Step 2 — confirm: "Delete [dish name] logged at [time]?"

Step 3 — delete:

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_delete_meal",
    "arguments": { "id": "<UUID>" }
  },
  "id": 2
}

Weekly report

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": { "name": "hash_weekly_report", "arguments": {} },
  "id": 1
}

List medications

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": { "name": "hash_get_medications", "arguments": {} },
  "id": 1
}

Add a medication

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_add_medication",
    "arguments": {
      "name": "<medication name>",
      "dosage": "<e.g. 500mg>",
      "frequency": "<e.g. twice daily>",
      "time_of_day": ["morning", "evening"],
      "notes": ""
    }
  },
  "id": 1
}

Delete a medication

Step 1 — get ID: hash_get_medications Step 2 — confirm with user Step 3:

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "hash_delete_medication",
    "arguments": { "id": <numeric id> }
  },
  "id": 2
}

Note: medication id is a number, not a string.


Bedtime summary

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": { "name": "hash_get_bedtime_summary", "arguments": {} },
  "id": 1
}

Nutrition chat

When: User asks a health/nutrition question.

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "nutrition_chat",
    "arguments": {
      "messages": [
        { "role": "user", "content": "<user's question>" }
      ]
    }
  },
  "id": 1
}

Parsing meal analysis data

The analysis field in meal history is always a JSON string — always JSON.parse() it first.

Two possible formats:

ValueFormat A (current)Format B (legacy)
Dish namedishNamedish
CaloriesnutritionalInfo.calories_kcalnutrition.calories
ProteinnutritionalInfo.proteins_gnutrition.protein
CarbsnutritionalInfo.carbohydrates_gnutrition.carbs
FatnutritionalInfo.fats_gnutrition.fat
FibernutritionalInfo.fiber_gnutrition.fiber
SugarnutritionalInfo.sugar_gnutrition.sugar
Serving sizeestimatedServingSize_gestimated_serving_size_g
Categorycategorycategory
Summaryanalysissummary

Detect format: dishName present → Format A. dish present → Format B.

Always display:

🍽 <dish name>
Calories: X kcal | Protein: Xg | Carbs: Xg | Fat: Xg | Fiber: Xg

Rules

  • Always use today's date (YYYY-MM-DD) when no date is specified.
  • Never guess a meal UUID or medication ID — look it up first.
  • Always confirm before deleting.
  • Medication id is a number — not a string.
  • Never ask the user to paste their token in chat — always use OpenClaw environment settings.
  • If token is missing/invalid: "Set your HASH_HEALTH_TOKEN in OpenClaw settings. Hash Health app → Settings → Advanced → Generate API Key."

Comments

Loading comments...