Workout Claw
PassAudited by ClawScan on May 15, 2026.
Overview
Workout Claw appears coherent and local-first, with the main cautions being that it relies on an unreviewed local CLI and can edit or delete local workout logs.
Before installing, make sure you trust the separate `workout-claw` CLI that this skill will call. Expect workout logs to be stored locally under `~/.workout-claw/`, and double-check session IDs before using delete commands.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the local CLI is missing, outdated, or not the expected program, the skill may fail or run unreviewed code.
The skill depends on a local executable, while the supplied package has no install spec or code files; users must separately trust and verify whatever `workout-claw` binary is on their system.
Use the `workout-claw` CLI via Bash.
Install `workout-claw` only from a trusted source and confirm which binary will run before using the skill.
A mistaken delete command could remove local workout history.
Deletion is a documented, purpose-aligned feature, but the lack of an interactive confirmation means an incorrect session ID could remove a workout entry immediately.
workout-claw delete <session-id> ... No confirmation prompt — the CLI is non-interactive by design.
Review the session ID before asking the agent to delete a workout, and keep backups if the logs are important.
Workout history and notes remain on the local machine and may be read in future workout-related interactions.
The skill intentionally stores persistent local workout history, which may include personal fitness data and free-text notes.
`~/.workout-claw/logs/<date>.json` — one JSON file per day, array of sessions
Avoid putting highly sensitive information in workout notes, and review or delete files under `~/.workout-claw/` if you no longer want them retained.