Strava

This skill appears to do what it says (call the Strava API and refresh tokens) but there are metadata inconsistencies and sensitive credential handling to consider before installing: - Metadata mismatch: the registry claims no required env vars but the SKILL.md and included script clearly need STRAVA_ACCESS_TOKEN, STRAVA_REFRESH_TOKEN, STRAVA_CLIENT_ID and STRAVA_CLIENT_SECRET. Ask the publisher to correct the manifest so required permissions are explicit. - Secrets handling: the README/SKILL.md suggests storing tokens in ~/.clawdbot/clawdbot.json (plaintext). The included refresh_token.sh prints new tokens to stdout rather than securely storing them. Prefer setting secrets via environment variables or a secure secrets store; if you must use the config file, restrict its filesystem permissions (chmod 600). - Review the script before running: the refresh script is short and readable, but you should inspect it locally to confirm it only calls Strava and does not send data elsewhere. - Trust and provenance: the source is listed as unknown. Only provide your Strava client secret and refresh token to skills from publishers you trust. If you have doubts, create a Strava app with limited scope or a throwaway account for testing. If the publisher updates the registry metadata to accurately list required env vars and documents secure handling of tokens (or implements a safe automatic config update mechanism), the concerns would be reduced.