Health Tracker

健康追踪 - 体重记录、卡路里计算、运动追踪

Security Scan

The skill's name, description, and runtime instructions are consistent: it is an instruction-only health-tracking helper that uses the clawhub CLI and does not request credentials or install code itself; there is a small manifest inconsistency (requires curl) and the README mentions npx installation which would fetch external code — worth a quick check before use.

Purpose & Capability

SKILL.md commands (clawhub health ...) match the described features (weight, calories, exercise, report). However _meta.json lists a required binary 'curl' even though the instructions never reference curl; the registry metadata presented earlier showed no required binaries, so the manifest is inconsistent but not clearly harmful.

Instruction Scope

Runtime instructions are limited to running clawhub CLI commands to record weight, calories, exercise, and request reports. They do not instruct reading arbitrary files, environment variables, or sending data to external endpoints. One caveat: pricing text mentions cloud sync (Pro/subscription) but SKILL.md does not clarify where/when data is uploaded — a privacy consideration.

Install Mechanism

The skill is instruction-only and includes no install spec or code files (lowest intrinsic risk). README suggests using 'npx clawhub@latest install health-tracker' which would fetch/execute external code at install time; that step is outside this skill bundle and should be treated like any external package installation.

Credentials

The skill does not request environment variables, credentials, or config paths. The only disproportionate item is the manifest's 'requires' entry for 'curl' which is not used in SKILL.md — this is inconsistent but not an immediate credential risk.

Persistence & Privilege

Flags are default: not always-included, user-invocable, and model invocation is enabled (normal). The skill does not request system-wide config changes or other skills' credentials.

Assessment

This skill appears to do what it claims and does not ask for credentials, but check two small issues before installing: (1) verify the source of the skill (the package owner/registry) because README suggests using npx which will fetch code from the network; only run that if you trust the publisher, (2) confirm the cloud-sync / Pro subscription behavior and where data is stored/transmitted (privacy), and (3) note the _meta.json lists 'curl' though the instructions don't use it — benign but inconsistent. If you need higher assurance, ask the publisher for a repository link or review the code that 'npx' would install.

健康追踪工具，管理你的健康。

功能

• ✅ 体重记录
• ✅ 卡路里计算
• ✅ 运动追踪
• ✅ 饮水提醒
• ✅ 健康报告

使用

# 记录体重
clawhub health weight --value 70 --unit kg

# 卡路里计算
clawhub health calories --food "苹果" --amount 200

# 运动记录
clawhub health exercise --type "跑步" --duration 30

# 健康报告
clawhub health report --week 2026-W16

定价

版本	价格	功能
免费版	¥0	基础记录
Pro 版	¥49	全部功能
订阅版	¥12/月	Pro+ 云同步