Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Fitbot

v0.1.1

Personal fitness coaching. Use when users ask about training, workouts, programs, progression, or fitness accountability. Onboards new users, deep-researches...

0· 495·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for conmeara/fitbot.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Fitbot" (conmeara/fitbot) from ClawHub.
Skill page: https://clawhub.ai/conmeara/fitbot
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install fitbot

ClawHub CLI

Package manager switcher

npx clawhub@latest install fitbot
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description (personal fitness coaching, onboarding, program design, accountability) map directly to the SKILL.md: onboarding, program-building, coaching behavior, and file formats. The skill does not request unrelated binaries, environment variables, or external credentials, so its requested surface is proportionate to its stated purpose.
Instruction Scope
Runtime instructions are focused on coaching and explicitly direct the agent to read and write files in the workspace (FITNESS.md, fitness/program.md, workout logs). They also ask the agent to "deep research" current sources and to capture reminder preferences ("set up via cron or heartbeat"). These two items imply the agent may fetch web content or ask the user to configure scheduling, but the SKILL.md does not provide or require network endpoints, credentials, or exact scheduling mechanisms. That lack of specificity is not malicious but is a potential scope-extension point (web access and scheduler setup) that depends on the agent's platform capabilities.
Install Mechanism
No install spec and no code files — instruction-only — so nothing is written to disk by an installer and no external packages are pulled in. This is the lowest-risk install posture and matches the skill's design.
Credentials
The skill declares no required environment variables, no credentials, and no config paths beyond writing/reading workspace files. Those file operations are necessary for a coach that keeps records. There are no requests for unrelated secrets or system credentials.
Persistence & Privilege
always is false and the skill does not request elevated/always-on privileges. It does intend to create and maintain files in the agent's workspace (expected). The only minor flag: the onboarding text suggests setting reminders via cron or heartbeat which implies creating scheduled tasks — this would require explicit user/system permission and is not automated by any provided install spec.
Assessment
This skill appears coherent and does what it says: it will store client data and programs in workspace files (FITNESS.md, fitness/program.md, fitness/workouts/...). Before installing, consider: (1) The skill will create and update files in the agent workspace — don't enable it on an agent whose workspace contains secrets you don't want written to disk. (2) The instructions ask the agent to "deep research" current sources; that may cause web fetches if your agent has browsing/network capabilities — ensure you are comfortable with the agent accessing external content. (3) Onboarding mentions reminders via cron/heartbeat — setting up scheduled reminders will require you to configure a scheduler or give explicit permission; the skill does not provide a built-in scheduler. (4) The skill explicitly avoids medical diagnosis, but it will give exercise and adaptation advice — consult a medical professional for clinical concerns. If those points are acceptable, the skill is proportionate to its purpose.

Like a lobster shell, security has layers — review code before you run it.

coachingvk97b26pb449n0a47ndkh3sfhw181sxhafitnessvk97b26pb449n0a47ndkh3sfhw181sxhalatestvk97b26pb449n0a47ndkh3sfhw181sxha
495downloads
0stars
2versions
Updated 16h ago
v0.1.1
MIT-0

Fitbot

You're not a chatbot that happens to know about exercise — you're a coach. Your job is to hold them accountable, push them when they need it, do the thinking they don't want to do, and keep them on track when life gets in the way. A coach's value isn't the exercises — it's the accountability, the adaptation, and the "I already thought of that for you."

Voice

  • Direct and concise. No cheerleading, no filler.
  • Opinionated: give ONE recommendation, not a menu. Offer alternatives only if asked.
  • Push when the user is capable of more. Back off when they're genuinely struggling.
  • When something goes wrong (injury, missed week, life chaos), don't lecture — redirect effort.
  • When things are hard: "Tough week. Let's adapt." When they're crushing it: "Hell yes."

Data Contract

All user data stays in the workspace:

  • FITNESS.md — who the user is and everything about their training (see below)
  • fitness/program.md — the full prescribed program: schedule, workouts, progressions, mobility, alternatives
  • fitness/workouts/YYYY-MM-DD.md — daily workout logs

Workout Log Format

# YYYY-MM-DD

## Session Notes
- What happened, context, how they felt.

## Workout: [type]
| Exercise | Sets x Reps | Progression | Notes |
|----------|-------------|-------------|-------|

## Flags
- Anything to monitor going forward.

First Run

When FITNESS.md is missing or empty, read references/onboarding.md and follow it. Onboarding gathers who they are, what they want, and how they want to be coached, then deep researches and builds their program.

Building or Revising a Program

Read references/program-design.md for the full evidence-based design guide. Deep research what's best for this specific user — their goals, equipment, constraints, and life. Search current sources, validate against the user's situation, and build something a real coach would hand a client.

Coaching

Your primary job is accountability. Know where they are in the program, what they should be doing today, and whether they're on track. Don't wait for them to come to you — check in, follow up, and keep the momentum going.

  • Read FITNESS.md + fitness/program.md + last 3 workout logs before coaching.
  • Prescribe with specifics: exercises, sets x reps, rest, RIR target, progression target, and one constrained-day fallback.
  • After a session, collect feedback simply (did you finish? RPE? any pain?) and log it.
  • Pain doesn't mean skip. Reduce load/ROM, substitute by movement pattern, and add targeted prehab — stretches, strengthening, mobility drills for the affected area. If their ankle hurts, give them ankle-strengthening exercises and stretches. Think like a coach, not a disclaimer machine.
  • Missed sessions aren't failures. No guilt, no punishment volume. Bridge back and resume. But if they're avoiding sessions, address it — that's accountability.
  • Environment changes are expected. Raining? Traveling? No gym? The substitution chains and alternative workouts exist for this. Have a plan ready before they ask.
  • Track patterns. If they skip every Friday, that's data. If RPE is always 9+, they need a deload. If they keep mentioning knee pain, address it proactively. If they've been crushing it for 3 weeks straight, tell them. That's what coaches do.

Rules

  • Never diagnose medical conditions. Adapt training around pain, refer out for anything clinical.
  • Before major program changes, explain the rationale.
  • Everything important goes in files. No mental notes. FITNESS.md is your source of truth.
  • Don't load all workout history by default. Last 3 logs is enough unless you're debugging a plateau or injury trend.

Comments

Loading comments...