Security

FoodLoop Analyzer

Try it

Reverse-engineer and analyze any FoodLoop AI deployment. Use when given a FoodLoop AI URL and asked to analyze, audit, trace, map, or inspect its workflow, A...

What it does

Reverse-engineer and analyze any FoodLoop AI deployment. Use when given a FoodLoop AI URL and asked to analyze, audit, trace, map, or inspect its workflow, API, or architecture.

The skill document

FoodLoop AI — Analyzer Skill

Reverse-engineers a FoodLoop AI deployment: maps routes, traces API endpoints, identifies the backend, and reconstructs the full user workflow.

Workflow

Step 1 — Identify Backend URL

Fetch the frontend's JS bundle and look for the backend host string:

curl -s "https:///assets/$(curl -s 'https:///' | grep -oP 'src="/assets/\K[^"]+')" | tr '"' '\n' | grep -E "https?://[^/]+\.(onrender|railway|vercel|render)" | sort -u

Or grep the JS for api/ route strings directly:

curl -s "https:///assets/.js" | tr '"' '\n' | grep -E "^/api/" | sort -u

Step 2 — Fetch OpenAPI Spec

Most FastAPI backends expose their spec at:

https:///openapi.json

This is the canonical source of truth — pull it first and extract all paths + schemas:

curl -s "https:///openapi.json" | python3 -c "
import sys, json
spec = json.load(sys.stdin)
for path, methods in spec['paths'].items():
    for method, details in methods.items():
        print(f'{method.upper():6} {path} — {details.get(\"summary\",\"?\")}')
for name, schema in spec.get('components',{}).get('schemas',{}).items():
    print(f'Schema: {name}: {list(schema.get(\"properties\",{}).keys())}')
"

Step 3 — Map Pages

Probe common Next.js routes:

for route in "" "home" "scan" "analyze" "result" "dashboard" "about" "how-it-works" "login" "signup"; do
  curl -s -o /dev/null -w "$route → HTTP %{http_code}\n" "https:///$route"
done

Step 4 — Trace the User Workflow

Use the OpenAPI spec as reference. The core workflow is:

  1. InputPOST /api/analysis/text or POST /api/analysis/upload
  2. Detect → AI identifies leftovers (label, display_name, confidence, safety_flag)
  3. Clarify (optional)POST /api/analysis/{id}/clarify
  4. RecommendPOST /api/recipes/recommend/{analysis_id} → Indonesian recipe list
  5. CookPOST /api/recipes/sessions/{id}/start → guided session
  6. TrackPOST /progress, POST /finish, POST /stop
  7. Remind → Notifications via GET /api/notifications/preview
  8. Analyze → Dashboard at /api/dashboard/summary
  9. ExportPOST /api/pdf/generate/{recommendation_id}

Step 5 — Test the API

Test demo auth:

curl -s -X POST "https:///api/auth/demo" \
  -H "Content-Type: application/json" \
  -d '{"name":"Test User","email":"test@example.com"}'

Test text analysis:

curl -s -X POST "https:///api/analysis/text" \
  -H "Content-Type: application/json" \
  -d '{"text":"nasi sisa, telur, sayuran","condition":"segar"}'

Step 6 — Check Config

curl -s "https:///api/config/status"

Step 7 — Document Findings

Save the complete analysis to: ~/.openclaw/workspace/foodloop__.md

Include: architecture table, all endpoints, workflow steps, test results, and schema summaries.

Analyze a Photo (from chat)

When the user sends a photo directly in chat, analyze it using the upload endpoint:

Step 1 — Save the photo to a temp file:

# If image is a base64 data URL (most common from chat):
python3 -c "
import sys, base64, re
data = sys.stdin.read()
# Handle data URL or raw base64
if data.startswith('data:'):
    header, data = data.split(',', 1)
img_bytes = base64.b64decode(data)
ext = 'jpg'
if 'png' in header.lower(): ext = 'png'
path = '/tmp/foodloop_upload.jpg'
with open(path, 'wb') as f:
    f.write(img_bytes)
print(path)
" <<< "$(cat /path/to/image_data_or_data_url)"

# Or if the photo is already saved to a known path, use it directly

Step 2 — Upload and analyze the photo:

curl -s -X POST "https:///api/analysis/upload" \
  -F "file=@/tmp/foodloop_upload.jpg" \
  -F "condition=segar"

The condition field is optional. Common values: segar (fresh), ragu (uncertain).

Step 3 — Parse and present the results:

curl -s "https:///api/analysis/{analysis_id}"

Output format — same AnalysisResponse as text analysis:

  • items[] — detected leftovers with label, display_name, confidence, safety_flag
  • safety_level — overall safety assessment
  • warnings[] — food safety notes
  • recommendations[] — Indonesian recipe suggestions with score, reason, ingredients, steps

Supported image formats: JPEG, PNG, WebP (detected automatically by backend from Content-Type)

Key Endpoints (FastAPI/FoodLoop AI Backend)

MethodPathSummary
GET/api/healthHealth check
POST/api/auth/demoDemo login
GET/api/auth/google/startGoogle OAuth start
POST/api/analysis/textText analysis
POST/api/analysis/uploadImage upload analysis
GET/api/analysis/{analysis_id}Get analysis result
POST/api/analysis/{analysis_id}/clarifyClarify detected items
POST/api/recipes/recommend/{analysis_id}Get recipe recommendations
GET/api/recipes/recommendation/{id}Get recommendation detail
POST/api/recipes/sessions/{id}/sessionsStart cooking session
POST/api/recipes/sessions/{id}/finishFinish cooking session
POST/api/recipes/sessions/{id}/stopStop cooking session
POST/api/recipes/sessions/{id}/progressUpdate step progress
GET/api/dashboard/summaryDashboard metrics
GET/api/notifications/previewPreview reminder messages
POST/api/pdf/generate/{id}Generate recipe PDF
GET/api/admin/summaryAdmin summary

Backend Detection Pattern

FoodLoop AI backends expose a FastAPI doc UI at /docs. If /openapi.json returns a valid spec, confirm it contains "FoodLoop AI" in the info.title field.

Reference

For the complete API schema, endpoint parameters, request/response schemas, and live test examples, see references/api_workflow.md.

Related skills

Loop Returns (loopreturns.com). Use this skill for ANY Loop Returns request — searching and reading data. Whenever a task involves Loop Returns, use this ski...

1 installs

Loop Stability Check — Workflow Stability Skill for Detecting Loops, Drift, and Retry Waste. Use it when the user needs a disciplined protocol and fixed outp...

15 installs

Loops (loops.so). Use this skill for ANY Loops request — reading, creating, updating, and deleting data. Whenever a task involves Loops, use this skill inste...

8 installs

Improve important deliverables by looping them through multiple isolated AI reviewers, each evaluating from a different angle, until all reviewers give full...

2 installs1 stars

Security and compliance auditing tool for AI agents. Scans code for vulnerabilities, checks GDPR/CCPA compliance, generates risk reports with remediation guidance.

Review an LLM agent design and find where it will be unreliable, expensive, or unsafe. Use when asked to review an agent architecture, critique a multi-step/...

1 installs