Health Guardian

v1.0.0

Proactive health monitoring for AI agents. Apple Health integration, pattern detection, anomaly alerts. Built for agents caring for humans with chronic conditions.

3· 1.4k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the included code: import_health.py parses Apple Health exports and analyze.py runs anomaly detection. However the SKILL.md and config.example.json instruct using a configurable data_source (iCloud Drive/Health Auto Export) while import_health.py uses a different hardcoded path (~/Library/Mobile Documents/iCloud~com~ifunography~HealthExport/Documents and an AutoSync subpath). The SKILL.md promises alert delivery channels (e.g., Telegram) and a scripts/summary.py, but there is no summary.py and no notification/Telegram code in the repository. These mismatches reduce coherence.
!
Instruction Scope
SKILL.md asks you to create a config.json with data_source and alert_channel and to add a cron job; analyze.py respects config.json for data_dir, but import_health.py does NOT read config.json and instead reads a hardcoded iCloud export path and writes to ./data. The skill instructs to expect local-only operation; the code contains only local file I/O and no network calls, which matches that claim. However, instructions imply alert delivery and auxiliary scripts that do not exist — the agent could be led to believe alerts are sent externally when they are not implemented.
Install Mechanism
No install spec — instruction-only with included Python scripts. This is lower-risk from an install standpoint (nothing downloaded during install). The code will write files under the skill's data/ directory and uses /tmp for temporary work; these are expected for this task.
Credentials
The skill requests no environment variables or credentials, which is appropriate for a local importer/analyzer. One caution: import_health.py accesses a user iCloud directory (HOME-based path); that is necessary for Apple Health Auto Export but is sensitive data access and is done without asking for an explicit data_source override in that script (config.json is ignored by the importer).
Persistence & Privilege
always is false and the skill does not request elevated system privileges. It only reads user home directories and writes to a local data/ directory inside the skill. It does not modify other skills or system-wide agent settings.
What to consider before installing
What to check before installing or using this skill: - Review the importer script (scripts/import_health.py) carefully. It uses a hardcoded iCloud export path (~/Library/Mobile Documents/iCloud~com~ifunography~HealthExport/Documents and an AutoSync subfolder) instead of the data_source you are instructed to put in config.json. If your Health Auto Export files live elsewhere, the script may not see them. Modify the script to read config.json or ensure the paths match. - There is no network/telemetry code in the provided files, which matches the README claim that "Nothing leaves your machine." Still, confirm there are no unexpected imports or remote calls before running. - The SKILL.md mentions alert channels (telegram) and scripts/summary.py, but summary.py is missing and no notifier code exists. If you expect alerts to be pushed to Telegram or other channels, you will need to implement that and provide credentials; this skill will just print alerts to stdout by default. - Run the importer/analyzer in a sandbox or with a non-critical test dataset first. Because the importer reads files from your home/iCloud area, test with a copied subset of data to confirm behavior and dedup/merge logic. - Backup existing data/ files before first run; the importer performs atomic writes but will create/modify data/vitals.json. - If you plan to use this with a human under your care, validate the detection thresholds and outputs clinically — this is an assistive tool, not a medical device. - If you want greater assurance, request or locate the upstream repository (package.json points to a GitHub URL) and confirm authorship and recent updates. If you lack the ability to audit the code, avoid providing any external credentials or automating delivery of alerts until the missing notifier functionality and path mismatches are resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk9765yczjjkxs0denkm4vccshh80je0b

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments