Fitness
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: fitness Version: 1.0.1 The skill bundle is designed for auto-adaptive fitness tracking and coaching. All files (SKILL.md, coaching.md, profiles.md, sources.md) contain instructions and documentation solely focused on this purpose. SKILL.md instructs the agent to absorb fitness data, persist user preferences and learned data in a local file (`~/fitness/memory.md`), and adapt its coaching style. There are no instructions for unauthorized shell execution, network calls to external endpoints for exfiltration, reading sensitive system files, or any form of prompt injection designed to subvert the agent's core function for malicious purposes. The references to external data sources in `sources.md` are descriptive of potential data inputs, not commands to perform unauthorized integrations or data fetches.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may remember sensitive fitness, health, schedule, recovery, or injury-related details across future interactions, even when the user did not intend a particular source or conversation to be used for fitness memory.
This directs the agent to collect health and fitness information broadly and store it persistently, without clear limits on approved sources, retention, user review, or deletion.
Absorb fitness mentions from ANY source ... User preferences and learned data persist in: `~/fitness/memory.md` ... Observe and fill.
Require explicit user approval for each data source, keep source labels, provide a way to review and delete `~/fitness/memory.md`, and avoid storing medical or injury details unless the user opts in.
If the user connects these services, the agent could access sensitive activity, recovery, heart-rate, race, or social-fitness information.
These integrations are purpose-aligned for a fitness skill, but they can involve health-account or social-fitness data if connected. The artifacts do not show credential handling or token use.
Wearable Integrations - Apple Watch/HealthKit, Fitbit, Garmin, Whoop, Oura ... External Sources - Race results: Strava ... Gym apps: Strong, Hevy
Only connect accounts and exports you intend the skill to use, and prefer narrow, revocable permissions where available.