ClawCoach Core
v1.0.1AI health coach with dual personality modes (Supportive Mentor or Savage Roaster). Tracks nutrition from food photos, provides data-driven coaching, and hold...
⭐ 0· 470·0 current·0 all-time
byNiko Vijayaratnam@authoredniko
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's purpose (local AI health coach, food/photo logging) aligns with reading/writing a ~/.clawcoach/ profile and food log. Requesting an ANTHROPIC_API_KEY is plausible for generating responses, but the SKILL.md explicitly says the key "is not accessed directly by this skill," which conflicts with declaring it as a required env var. That mismatch is unexplained.
Instruction Scope
The SKILL.md asserts "No data is sent to any external service. No data leaves your machine," yet it delegates image/text analysis to a separate 'clawcoach-food' skill and refers to an onboarding 'clawcoach-setup' skill. Because those other skills are not included here, there's no guarantee they preserve local-only processing — the instructions give the agent broad discretion to call those skills without documenting their privacy behavior. The skill otherwise scopes file I/O to ~/.clawcoach/, which is appropriate for the described functionality.
Install Mechanism
This is an instruction-only skill with no install spec or code files; nothing is written to disk by an installer. That is the lowest-risk install pattern.
Credentials
Only one env var (ANTHROPIC_API_KEY) is required, which is proportionate if the skill directly calls Anthropic. However the SKILL.md simultaneously claims the key is used by OpenClaw's backend and "is not accessed directly by this skill," creating ambiguity about who actually needs the key and why the skill declares it as required. The declaration without clear justification increases risk of accidental credential exposure or user confusion.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and confines persistent data to ~/.clawcoach/. It reads and writes user profile and food-log files — expected for this purpose and proportionate to functionality.
What to consider before installing
This skill looks like a locally scoped coaching assistant, but there are two things to clarify before installing: (1) Why does it declare ANTHROPIC_API_KEY as required if the SKILL.md says the key "is not accessed directly by this skill"? Ask the author whether the agent or the platform backend uses your key, and whether you can use a platform-managed key instead of putting a personal Anthropic key into your environment. (2) The skill delegates image and text analysis to other skills ('clawcoach-food' and 'clawcoach-setup') — inspect those companion skills to confirm they do not upload photos or logs to external services. If the developer confirms that all processing is local (or that external services are explicitly documented and consented to), the contradictions would be resolved. If you cannot get that confirmation, treat this as higher risk and avoid supplying your personal API key or sensitive data; consider running any image analysis through known, audited tools instead.Like a lobster shell, security has layers — review code before you run it.
accountabilityvk97ajw5yyphap082arak607n1d81m318coachingvk97ajw5yyphap082arak607n1d81m318fitnessvk97ajw5yyphap082arak607n1d81m318healthvk97ajw5yyphap082arak607n1d81m318latestvk9789q4rrsv3dq4tacet5jvs7d81qh6pnutritionvk97ajw5yyphap082arak607n1d81m318roastvk97ajw5yyphap082arak607n1d81m318
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvANTHROPIC_API_KEY