Skill: ollieparsley/zenplus-health (version 1.0.4)

--- name: Zen+ Health description: Workplace wellness for stress, anxiety, and burnout - mindfulness exercises, breathing techniques, mood check-ins, notifications, timeline, and a full wellbeing catalogue from Zen+ Health version: 1.0.4 author: Zen+ Health category: wellness requires_auth: true auth_type: api_key base_url_env: ZEN_API_BASE_URL api_key_env: ZEN_API_KEY metadata: {"openclaw":{"requires":{"env":["ZEN_API_KEY","ZEN_API_BASE_URL"],"bins":["curl","jq"]},"primaryEnv":"ZEN_API_KEY"}} --- # Zen+ Health Skill Workplace wellness for stress, anxiety, and burnout. Access mindfulness exercises, breathing techniques, mood check-ins, notifications, your activity timeline, and a full wellbeing catalogue directly from OpenClaw. ## When to Use Use this skill when the user: - Feels stressed, overwhelmed, or burnt out - Mentions anxiety, tension, or nervousness - Asks for mindfulness exercises, breathing techniques, or meditation - Wants help relaxing, calming down, or managing emotions - Requests wellness activities, self-care ideas, or mental health support - Asks about their wellness progress or activity history When triggered by stress or anxiety, browse the catalogue for a suitable exercise and present it with context and a direct link. ## Authentication This skill requires a personal API key from Zen+ Health. 1. Log in to your Zen+ Health account 2. Navigate to Profile → API Keys 3. Create a new API key. New keys are created with fixed read-only scopes: - `user:restricted` - `timeline:read` - `notification:read` - `catalog:read` - `working_hours:read` 4. Set environment variables: ```bash export ZEN_API_BASE_URL="https://api.zenplus.health" export ZEN_API_KEY=[REDACTED_SECRET] ``` API keys are read-only and can be revoked at any time from your Zen+ Health settings. ## Available Commands ### Get Notifications Fetch your recent Zen+ Health notifications. ```bash curl -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/me/notifications?limit=10" ``` Example use: "Show me my latest Zen+ notifications" ### Get Timeline View your timeline of completed activities and progress. ```bash curl -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/me/timeline?days=7" ``` Example use: "What's on my Zen+ timeline this week?" ### Browse Catalogue Explore available wellness tasks and activities. ```bash curl -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/catalog" ``` Example use: "Show me the Zen+ Health task catalogue" ### Get User Profile Fetch your user profile and preferences. ```bash curl -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/me" ``` Example use: "What's my Zen+ Health profile?" ## Response Format All endpoints return JSON. Use `jq` to parse: ```bash # Get notification titles curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/me/notifications" | jq -r '.notifications[].title' # Count timeline events curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/me/timeline" | jq '.events | length' # List catalogue categories curl -s -H "Authorization: Bearer ${ZEN_API_KEY}" \ "${ZEN_API_BASE_URL}/v1/catalog" | jq -r '.tasks[].category' | sort -u ``` ## Additional Resources - Full API Documentation: See `more_info_url` in API responses - Security: Read [SECURITY.md](./SECURITY.md) - Help: [https://zenplus.health/support](https://zenplus.health/support) ## Notes - API keys are read-only - they cannot modify data - Rate limits apply (see API response headers) - When giving a user an exercise, ALWAYS include the url to the exercise in the app - When deciding on an exercise for a user, always check the more info URL to gain more context - When giving an exercise give the reason and explain that it's from Zen+ Health research and knowledge base.

path: SECURITY.md
content: # Security Guidelines for Zen+ Health OpenClaw Skill

## Overview

The Zen+ Health OpenClaw skill uses **personal API keys** for authentication. This document explains the security model and best practices.

## Authentication Method

### API Key Format

```
zen_ak_<40 hexadecimal characters>
```

Example: `zen_ak_a1b2c3d4e5f6789012345678901234567890abcd`

### Storage and Hashing

- **Client-side**: Store API keys in environment variables (never hardcode)
- **Server-side**: All API keys are SHA-256 hashed before storage
- **Transmission**: Always use HTTPS (`https://api.zenplus.health`)

## Permissions and Scopes

API keys for this skill are **read-only** with limited scopes:

| Scope | Access | Can Modify? |
|-------|--------|-------------|
| `user:restricted` | View limited profile data | ❌ No |
| `timeline:read` | View activity history | ❌ No |
| `notification:read` | View notifications | ❌ No |
| `catalog:read` | Browse task catalogue | ❌ No |
| `working_hours:read` | View working hours | ❌ No |

**This skill cannot**:
- Modify your profile
- Create or delete tasks
- Send notifications
- Access payment information
- Change your settings

## Best Practices

### ✅ Do

- Store API keys in environment variables (`ZEN_API_KEY`)
- Use separate API keys for different integrations
- Revoke keys immediately if compromised
- Monitor API key usage in your Zen+ Health settings
- Use the minimum required scopes

### ❌ Don't

- Hardcode API keys in scripts or code
- Share API keys in chat logs or screenshots
- Share API keys anywhere
- Commit API keys to version control
- Use production keys for testing
- Grant unnecessary scopes

## Key Management

### Creating a Key

1. Log in to [zenplus.health](https://app.zenplus.health)
2. Navigate to **Settings → API Keys**
3. Click **"Create New API Key"**
4. Name it (e.g., "OpenClaw Integration")
5. **Copy the key immediately** - it won't be shown again

### Revoking a Key

1. Go to **Settings → API Keys**
2. Find the key in your list
3. Click **"Revoke"**
4. Key is immediately invalidated across all systems

### Key Rotation

Rotate API keys every 90 days or immediately if:
- Key may have been exposed
- Employee/contractor leaves
- Integration is no longer in use
- Suspicious API activity detected

## Rate Limiting

API keys are rate-limited to prevent abuse. Rate limit headers are returned in responses:
```
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1707824400
```

## Security Model

### What Zen+ Health Protects

✅ API keys are secure
✅ HTTPS enforced for all API requests  
✅ API keys are single-user scoped  
✅ API keys have no access to change data
✅ Audit logs for all API requests

### What You Must Protect

🔐 Keep `ZEN_API_KEY` environment variable secure  
🔐 Don't share keys between users  
🔐 Revoke keys when no longer needed  
🔐 Use separate keys for dev/staging/production

## Privacy Considerations

### Data Access

This skill can read:
- Your wellness notifications
- Your activity timeline
- Your profile information (name, email, preferences)
- Available task catalogue (public data)

This skill **cannot** read:
- Other users' data
- Payment information
- Password or credentials
- Private notes, journal entries, screening results, past task activity, check-ins.

### Data Transmission

- All API requests use HTTPS/TLS 1.3
- Data is encrypted in transit
- No data is cached by OpenClaw (unless you configure it)
- API responses may be logged by your OpenClaw instance

## Incident Response

### If Your API Key is Compromised

1. **Immediately revoke** the key at [zenplus.health/settings/api-keys](https://zenplus.health/settings/api-keys)
2. **Review usage logs** for unauthorized access
3. **Create a new key** with a unique name
4. **Update your environment variables** with the new key
5. **Contact support** if suspicious activity detected: [[REDACTED_SECRET]](mailto:[REDACTED_SECRET])

### Reporting Security Issues

Found a security vulnerability? Report it responsibly:

- **Email**: [[REDACTED_SECRET]](mailto:[REDACTED_SECRET])

**Do not** disclose security vulnerabilities publicly until we've had a chance to address them.

## Questions?

- **Documentation**: [zenplus.health/api/docs](https://zenplus.health/api/docs)
- **Support**: [[REDACTED_SECRET]](mailto:[REDACTED_SECRET])
- **Security**: [[REDACTED_SECRET]](mailto:[REDACTED_SECRET])


path: README.md
content: # Zen+ Health OpenClaw Skill

Bring your wellness data into OpenClaw. Access notifications, timeline, and task catalogue from any chat platform.

## What This Skill Does

- 📬 **Notifications**: Get your latest wellness notifications and reminders
- 📅 **Timeline**: View your activity history and progress tracking  
- 📚 **Catalogue**: Browse available wellness tasks and activities
- 👤 **Profile**: Access your user profile and preferences

## Quick Start

1. **Get an API key** from [zenplus.health/settings/api-keys](https://zenplus.health/settings/api-keys)
2. **Configure the skill**:
   ```bash
   export ZEN_API_BASE_URL="https://api.zenplus.health"
   export ZEN_API_KEY="zen_ak_your_40_character_key"
   ```
3. **Ask your OpenClaw**:
   - "Show my Zen+ notifications"
   - "What's on my Zen+ timeline?"
   - "Browse the Zen+ Health catalogue"

## Security

✅ **Read-only access** - API keys cannot modify your data  
✅ **Revocable** - Disable keys instantly from your settings  
✅ **Hashed** - Keys are securely hashed server-side  
✅ **Scoped permissions** - Only request what you need

See [SECURITY.md](./SECURITY.md) for full security details.

## Example Conversations

**User**: "Show me my latest Zen+ notifications"  
**OpenClaw**: *Fetches and displays your 10 most recent notifications*

**User**: "What is on my timeline for today Zen+ Health?"  
**OpenClaw**: *Queries your timeline for the day*

**User**: "What wellness exercises are available?"  
**OpenClaw**: *Lists the exercise catalog with categories*

## API Scopes Required

- `user:restricted` - View limited profile information
- `timeline:read` - Access activity timeline
- `notification:read` - Fetch notifications
- `catalog:read` - Browse task catalogue
- `working_hours:read` - View schedule preferences

## Links

- 🏠 [Zen+ Health](https://zenplus.health)
- 🔧 [Install OpenClaw Skill](https://zenplus.health/openclaw)
- 📖 [API Documentation](https://zenplus.health/api/docs)
- 🔐 [Manage API Keys](https://zenplus.health/settings/api-keys)
- 💬 [Support](https://zenplus.health/support)

## Distribution

**ClawHub**: Available on [clawhub.ai](https://clawhub.ai)  
**Marketing**: "Wellness where you work" - bring Zen+ Health into your existing workflow

## License

Proprietary - © Zen+ Health


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)