Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

My Fitness Claw

Your personal nutrition sidekick. Log meals in plain natural language, track macros (P/C/F) automatically, and visualize your progress on a beautiful real-ti...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
2 · 741 · 1 current installs · 1 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name and description (nutrition logging, macros/micros, dashboard) match the declared tools (canvas, read, write, edit) and the files present (nutrition/, canvas/, assets/). There are no unrelated binaries or external credentials requested.
Instruction Scope
Instructions direct the agent to read/write JSON under assets/nutrition/ and to write an offline mirror (assets/canvas/offline_data.js) and a memory file (memory/YYYY-MM-DD.md). This is consistent with a logging/dashboard skill, but it does mean the agent will persist user-provided meal data into workspace files and the agent memory directory as part of normal operation.
Install Mechanism
No install spec; the skill is instruction-only with small static assets and an offline_data.js mirror. The only external resource is Chart.js pulled from jsdelivr when the dashboard is opened in a browser, which is expected for a web dashboard.
Credentials
The skill requests no environment variables or external credentials. It declares the exact paths it will touch (nutrition/, canvas/, memory/), and the SKILL.md uses only those paths.
Persistence & Privilege
always is false and model invocation is allowed (defaults). The skill writes its own assets and memory files (normal for a local logging skill). It does not request permanent platform-wide privileges or modify other skills' configurations.
Assessment
This skill is coherent with its stated purpose, but it stores personal meal data in workspace files and the agent memory directory. Before using or publishing: (1) review and back up any existing memory/ or nutrition/ files you care about; (2) understand that the dashboard loads Chart.js from a public CDN when opened in a browser; (3) if you plan to share the skill, follow the included publishing checklist to sanitize daily_macros.json, offline_data.js, insights.json, targets.json, and memory/ to avoid leaking personal information.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.7.0
Download zip
latestvk97absy7962yavm8bjcgged0es8278wt

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

MyFitnessClaw

This skill manages your nutritional data and provides a visual dashboard for tracking macros and micronutrients using OpenClaw's native tools.

Core Files (Skill Assets)

  • assets/nutrition/daily_macros.json: The structured log of daily intake.
  • assets/nutrition/targets.json: Daily nutritional goals (calories, protein, carbs, fats, and 10 essential micronutrients).
  • assets/nutrition/insights.json: AI-generated tips based on current progress.
  • assets/nutrition/foods/common.md: A reference list of frequently eaten foods and their macros/micros.
  • assets/canvas/index.html: The visual dashboard for the OpenClaw Canvas.

Workflow: Logging Food

When the user mentions eating something:

  1. Estimate Macros & Micros: If the user doesn't provide them, estimate:
    • Macros: Calories, protein, carbs, fats.
    • Micros: Vitamin D3, Magnesium, Potassium, Zinc, Vitamin B6, Vitamin B12, Selenium, Vitamin C, Vitamin A, Vitamin E. Check assets/nutrition/foods/common.md first.
  2. Update Daily Log (Canonical): Update assets/nutrition/daily_macros.json. Include the micros object for both individual meals and the daily total.
  3. Update Offline Mirror: Update assets/canvas/offline_data.js with the same data, ensuring micronutrients are included.
    • Overwrite the file with: window.__OFFLINE_DAILY_MACROS = [...]; window.__OFFLINE_TARGETS = {...}; window.__OFFLINE_INSIGHTS = {...};
    • This ensures the dashboard works when opened via file:// (offline/browser-first).
  4. Update Memory: Log the meal in the agent's current daily memory file (e.g., memory/YYYY-MM-DD.md).
  5. Show Dashboard: Use canvas(action=present, url='skills/my-fitness-claw/assets/canvas/index.html') to show the updated dashboard inside OpenClaw.
  6. Provide Browser Access: After every log, provide the following message:

    📊 View in your browser:

    • Quick: Open skills/my-fitness-claw/assets/canvas/index.html in your browser (uses offline mirror).
    • Full: Run python -m http.server 8000 from the workspace root and visit http://localhost:8000/skills/my-fitness-claw/assets/canvas/index.html.
  7. Generate Insights: Analyze progress against goals in assets/nutrition/targets.json and update assets/nutrition/insights.json.

Persistence Rules:

  • assets/nutrition/*.json: Canonical storage.
  • assets/canvas/offline_data.js: Mirror for file:// viewing only.
  • Do not modify assets/canvas/index.html during routine logging.

Publishing Checklist (Public Safety)

Before publishing or sharing this skill:

  1. Sanitize Data: Clear nutrition/daily_macros.json by setting it to [].
  2. Sanitize Mirror: Clear canvas/offline_data.js to match the empty state: window.__OFFLINE_DAILY_MACROS = [];.
  3. Check Insights: Clear nutrition/insights.json or reset to template tips.
  4. Remove Personal Notes: Scrub nutrition/targets.json and memory/ of any sensitive info.
  5. Verify Assets: Ensure no private images or documents are in the assets/ folder.

Files

14 total
Select a file
Select a file to preview.

Comments

Loading comments…