Security audit
fitness-planner
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to implement a legitimate fitness planner, but there are inconsistencies and operational risks (undeclared external commands, build-time code execution, and external video searches) that you should understand before installing.
What to consider before installing: - Understand the build step: SKILL.md instructs you to run 'npm install' and 'npm run build' in the skill directory. Inspect package.json and package-lock.json for dependencies and any 'postinstall' scripts before running npm install, because those scripts execute on your machine. - External commands: The skill calls external CLIs (mcporter to call exa.web_search_exa and optionally yt-dlp) via child_process.exec to search for Bilibili videos. Those commands are not declared in the skill's required-binaries list. If you don't have these tools or you don't trust the mcporter/exa backend, the video-search feature will either fail or send your search queries (exercise names, possibly user-provided strings) to third-party services. - Local-only claim vs network calls: The README claims data is stored locally, but video search transmits queries externally. If you require full offline/local operation or want to avoid sending exercise names/searches externally, disable video-search calls or remove/replace the exec-based search calls. - File writes: The skill will create files under ~/.openclaw/workspace/fitness-planner (config.json, records, video-cache.json, plans). Back up or review those files if you care about their contents and retention. - Run in a sandbox if unsure: Because the skill runs build-time and runtime code and invokes external CLIs, consider running it in an isolated environment (container or dedicated account) and review the source (especially package.json and any scripts) before allowing it in a production agent. - If you want to proceed: ensure you trust the mcporter/exa endpoint or replace the video-search implementation with a trusted API, and install required CLIs (mcporter/yt-dlp) explicitly. If you prefer no external network calls, remove or stub out the notifier.searchExerciseVideo/searchExerciseVideos calls.
Static analysis
No suspicious patterns detected.