Likes Training Planner
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: grouptraining Version: 1.0.0 The skill bundle is a comprehensive integration for the 'My Likes' fitness platform, providing tools for training data analysis and calendar management. The scripts (e.g., fetch_activities.cjs, push_plans.cjs) are standard Node.js API clients that communicate exclusively with the official platform domain (my.likes.com.cn). Sensitive information like the LIKES_API_KEY is handled through standard environment variables or local configuration files (~/.openclaw/). The inclusion of an install.sh script and Telegram bot routing logic (bot-config.cjs) aligns with the stated purpose of providing a multi-role AI assistant, and no evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with access to this local config file may be able to use the Likes API with your account’s permissions.
The skill stores a Likes API key locally so later scripts can authenticate to the Likes account.
const CONFIG_FILE = path.join(CONFIG_DIR, 'likes-training-planner.json'); ... config.apiKey = apiKeyInput; ... fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
Use the Skill Center or environment-variable configuration carefully, protect ~/.openclaw files, and rotate the Likes API key if you suspect exposure.
A mistaken or unreviewed push could add or replace training plans for yourself or, with coach permissions, multiple camp members.
The push tool can add plans for the current user or camp members and can overwrite existing plans, while also providing a dry-run option.
--game-id <id> ... --user-ids <ids> ... --overwrite ... --dry-run Preview without pushing
Preview every generated plan, use --dry-run for checks, and only use --overwrite or bulk user IDs when you explicitly intend those changes.
Downloaded files may contain sensitive health, location, and training information that can persist on disk and be reused in later analysis.
The skill is designed to retrieve personal training history and activity details, including GPS data, and examples show writing results to local JSON files.
`fetch_activities.cjs` | Download training history ... `get_activity_detail.cjs` | Get single activity detail (with GPS)
Fetch only the date ranges and activity details you need, store output files in a private location, and delete old data files when no longer needed.
If the remote repository or latest release changes unexpectedly, the installer could run code different from what you reviewed here.
The recommended one-line installer runs a remote shell script from the repository, and the installer downloads the latest release rather than a pinned artifact.
curl -fsSL https://gitee.com/chenyinshu/likes-training-planner/raw/main/install.sh | bash
Prefer installing from the trusted ClawHub package or manually inspect/download a specific release before running installer commands.