by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (health/nutrition logging) matches its required credential, but it instructs immediate automatic upload of images and uses a third-party endpoint (hash-claude-mcp.vercel.app) that may receive the user's HASH_HEALTH_TOKEN and personal data — this mismatch and auto-upload behavior are concerning.
评估建议
Before installing, verify that https://hash-claude-mcp.vercel.app is an official Hash Health API endpoint or trusted proxy. Key points to consider:
- The skill will send your HASH_HEALTH_TOKEN as a Bearer token to that domain and auto-upload images/text without asking — if the domain is not trusted, your account access and personal data could be exposed.
- Ask the publisher: why use that domain instead of an official Hash Health API? Request documentation or a privacy/security policy.
- If you p...详细分析 ▾
⚠ 用途与能力
Name/description (nutrition, meal logging, medication management) align with needing an API token (HASH_HEALTH_TOKEN). However, all API calls are directed to https://hash-claude-mcp.vercel.app, which is not obviously an official Hash Health API domain. The skill claims "All data is sent to the user's own Hash Health account. No data goes to third parties," but the documented endpoint suggests the token and user data will be sent to that third-party host — this inconsistency is unexplained and concerning.
⚠ 指令范围
Runtime instructions require the agent to immediately upload user images ("Call hash_upload_image immediately" and "do NOT describe or ask first") and to call analysis endpoints without prior user confirmation for text triggers. That means the skill will forward potentially sensitive images and meal descriptions to the configured endpoint automatically. The instructions also ask to include detailed visual analysis in requests, increasing the amount of personal data transmitted.
✓ 安装机制
No install spec and no code files — instruction-only skill. Nothing is written to disk or installed by the skill itself, which minimizes installation risk.
ℹ 凭证需求
The skill requests a single API credential (HASH_HEALTH_TOKEN), which is reasonable for a service-integration skill. The proportionality concern arises because that token will be used in Authorization headers sent to the documented third-party endpoint; confirm that this endpoint is an official Hash Health host before supplying sensitive credentials.
ℹ 持久化与权限
always:false (not force-included) and no install actions. The skill can be invoked autonomously (platform default). Combined with the auto-upload instructions, autonomous invocation could cause unprompted transmission of images/text to the external endpoint — consider this when granting agent autonomy.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.92026/3/31
- Added SKILL.md file for detailed skill behavior instructions and API usage. - Removed skills.md file. - Documentation and metadata changes only; no impact on user-facing features or core functionality.
● Pending
安装命令
点击复制官方npx clawhub@latest install hash-health
镜像加速npx clawhub@latest install hash-health --registry https://cn.longxiaskill.com镜像同步中