TribuRuby Training Agent

Helps users check in rituals, track streaks, and view tribe activity on TribuRuby.

Security Scan

The skill's instructions and required API key are coherent with a TribuRuby integration, but there is a metadata mismatch about required env vars that you should verify before installing.

Purpose & Capability

The skill name/description describe checking in rituals, tracking streaks, and viewing tribe activity; the SKILL.md contains concrete API endpoints and an Authorization: Bearer header — this aligns with the stated purpose. However, the registry metadata earlier reported no required env vars or primary credential while SKILL.md declares TRIBURUBY_API_KEY (primaryEnv). That metadata mismatch is an inconsistency that should be resolved.

Instruction Scope

The runtime instructions are narrowly scoped to calling TribuRuby agent endpoints (authentication check, discover tribes, context, activity, check-in). They do not instruct reading unrelated files, system paths, or other environment variables.

Install Mechanism

This is an instruction-only skill with no install spec or code files, so nothing will be written to disk by an installer. That is the lowest-risk install pattern.

Credentials

SKILL.md requires a single secret TRIBURUBY_API_KEY for API calls which is proportionate for a third-party API integration. The concern is the registry metadata did not list this required env var or primary credential — verify the registry entry and ensure the key requested is the intended agent API key with least privilege.

Persistence & Privilege

The skill does not request always: true and is user-invocable; it does not request elevated persistence or modification of other skills. Autonomous invocation is allowed (platform default) but not combined with other red flags.

Assessment

This skill appears to do what it claims: it will make HTTP requests to https://triburuby.app/api/agent and send the TRIBURUBY_API_KEY in an Authorization: Bearer header. Before installing: (1) confirm the registry entry and SKILL.md agree about required env vars (the manifest you were shown omitted the API key), (2) create an agent-scoped API key in TribuRuby with minimal permissions and do not reuse other secrets, (3) verify you trust the homepage/source (https://triburuby.app) and check network egress logs if you run the agent in a monitored environment, and (4) plan to rotate the key if you stop using the skill. If the registry/origin is unclear or you cannot confirm the API key scope, treat this as higher risk.

TribuRuby Skill

This skill connects to the TribuRuby platform and helps users:

• Check in daily rituals
• Track training streaks
• View tribe activity
• Monitor progress in training protocols

Website: https://triburuby.app

---

Authentication

All API calls require:

Authorization: Bearer ${TRIBURUBY_API_KEY}

The API key must be created in TribuRuby under:

Settings → Agent API Keys

---

API Base

https://triburuby.app/api/agent

---

Initialization

Always verify authentication first:

GET /api/agent

If the response contains:

{"error":"Unauthorized"}

tell the user their key is invalid or expired.

---

Available Actions

Discover Tribes

GET /api/agent?action=my-tribes

Returns all tribes and protocol IDs.

Use this before making tribe-specific calls.

---

Get Training Context

GET /api/agent?action=context&tribeId=<id>{=html}&protocolId=<id>{=html}

Returns:

• ritual list
• completion status
• streak count
• quantities and units

---

Get Tribe Activity

GET /api/agent?action=tribe-activity&tribeId=<id>{=html}&protocolId=<id>{=html}

Optional:

&date=YYYY-MM-DD

Shows:

• tribe members
• weekly activity
• current streaks
• today's check-ins

---

Check In Ritual

POST /api/agent

Body:

{ "action": "check-in", "ritualId": "<id>{=html}", "protocolId": "<id>{=html}", "quantity": 45, "date": "YYYY-MM-DD" }

---

Workflow

When helping a user:

1. Fetch their tribes with my-tribes
2. Determine the relevant tribeId and protocolId
3. Retrieve context
4. Show tribe activity
5. Offer to check in incomplete rituals

---

Response Style

Keep responses:

• concise
• motivating
• focused on streaks and consistency

Athletes care most about streaks, progress, and accountability.