Lofy Fitness

Fitness accountability for the Lofy AI assistant — workout logging from natural language, meal tracking with calorie/protein estimates, PR detection with Epley formula, gym reminders based on weekly targets, and progress reports. Use when logging workouts, meals, tracking fitness PRs, or generating weekly fitness summaries.

Security Scan

The skill's instructions match its stated fitness purpose, but it mandates reading and updating a local data file containing sensitive health information without declaring where or how that data is protected, which raises privacy and persistence concerns.

Purpose & Capability

Name/description (workout logging, meal estimates, PR detection, weekly summaries) aligns with the instructions and the JSON schema in SKILL.md. The skill does not request unrelated credentials, binaries, or installs.

Instruction Scope

SKILL.md mandates: "Always read data/fitness.json before responding" and "Update the JSON immediately after any fitness conversation." That requires filesystem read/write access to a relative path that is not declared in the skill metadata. It will persist sensitive personal health data (workouts, meals, injuries) but includes no guidance on access control, encryption, retention, or user consent. This persistent logging behavior extends the skill's runtime footprint beyond ephemeral conversation context.

Install Mechanism

Instruction-only skill with no install spec and no code files — low installer risk. Nothing is downloaded or executed by an installer.

Credentials

The skill requests no environment variables or credentials, which is proportionate. However, the skill implicitly requires write access to a local file path (data/fitness.json) not declared in metadata; sensitive health information will be stored there with no stated protections.

Persistence & Privilege

Although always:false, the SKILL.md explicitly instructs the agent to persistently write to a data file after any fitness conversation. Combined with the platform's default autonomous invocation, this means the skill can create/update local logs of personal health data without per-interaction confirmation. There is no mention of limiting writes, user approval, or safe storage.

What to consider before installing

This skill appears to do what it claims, but it will read and write a local file named data/fitness.json containing personal health information (workouts, meals, injuries) and offers no details about where that file lives, who can read it, how long data is kept, or whether it's encrypted. Before installing: 1) Confirm where the agent's working directory (and data/fitness.json) will reside and that it's an appropriate, private location. 2) Consider requiring explicit user confirmation before each write or disabling autonomous invocation for this skill. 3) If you accept persistent storage, periodically inspect and back up or delete the file; consider encrypting it or keeping it inside an approved secure storage area. 4) Note that the skill origin/homepage is unknown — prefer skills with a verifiable source. If you want me to suggest a safer SKILL.md variant (e.g., prompt-based confirmation before writes, configurable storage path, retention policy), I can draft one.

Fitness Tracker — Workout & Health Accountability

Tracks workouts, meals, PRs, and fitness consistency. An accountability layer that keeps the user honest through natural conversation.

Data File: data/fitness.json

{
  "profile": { "goal": "", "weight_log": [], "start_date": null },
  "workouts": [],
  "meals": [],
  "prs": {},
  "weekly_summary": [],
  "current_week": { "workout_count": 0, "target": 0, "workouts": [] }
}

Workout Entry Format

{
  "date": "2026-02-07",
  "type": "strength",
  "muscle_groups": ["chest", "triceps"],
  "exercises": [
    { "name": "Bench Press", "sets": [{"weight": 185, "reps": 5}] }
  ],
  "duration_min": 60,
  "notes": ""
}

Meal Entry Format

{
  "date": "2026-02-07",
  "meal": "lunch",
  "description": "Chicken bowl with rice",
  "estimated_calories": 650,
  "estimated_protein_g": 45,
  "time": "12:30"
}

Parsing Natural Language

Workouts

• "bench 185x5 185x4" → Bench Press, 2 sets: 185×5, 185×4
• "tricep pushdowns 50x12 x3" → 3 sets of 50×12
• "went for a 5k run, 28 minutes" → cardio, running, 5km, 28min
• "did legs" (no details) → log muscle group, note "details not provided", still counts

Meals

• "had chipotle for lunch" → estimate ~650 cal, ~40g protein
• "protein shake after gym" → estimate ~200 cal, ~30g protein
• "skipped breakfast" → note it; if 3+ day pattern, gently mention

PR Detection

After parsing workouts, check each exercise against stored PRs:

• Epley 1RM = weight × (1 + reps/30)
• If new 1RM exceeds stored PR: update and celebrate
• Only celebrate PRs, not every workout

Instructions

1. Always read data/fitness.json before responding about fitness
2. Update the JSON immediately after any fitness conversation
3. Keep responses short — log confirmation + one comment
4. Nudge logic: max 1 gym reminder per day, only if behind weekly target
5. Track consistency over intensity — showing up matters more
6. If user mentions injury or pain, suggest rest. Never push through pain
7. Weekly report: show trends (improving? plateauing? declining?) with data