ClawHub

BestYou Coach Dashboards

v1.0.0

Render BestYou health data as visual Dark Glass dashboards via OpenClaw canvas. Daily briefings, action plans, progress snapshots, weekly summaries, meal ana...

⭐ 0· 83·0 current·0 all-time
by@kentsteffen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
Name/description, required env var (BESTYOU_API_KEY), and instructions all align: the skill fetches BestYou data via an MCP server and renders local HTML templates. One small mismatch: registry metadata lists no required config paths, but SKILL.md and INSTALL.md explicitly instruct the user to create and use ~/.openclaw/workspace/config/mcporter.json (the mcporter config). This is expected for operation but is not reflected in the declared metadata.
✓
Instruction Scope
SKILL.md confines runtime actions to: verifying/installing mcporter, creating a mcporter config that contains the BESTYOU API key, calling bestyou.* tools via mcporter, populating local HTML templates from assets/, inlining CSS, and presenting via canvas. The instructions do not ask the agent to read unrelated system files or other credentials. The agent will cause network requests to the BestYou MCP endpoint when mcporter calls are made.
ℹ
Install Mechanism
This is an instruction-only skill (no install spec). It tells the user to install mcporter via `npm install -g mcporter`. That is a normal but higher-risk recommendation than using an audited system package because global npm installs run code from the npm registry — users should verify the package and version before installing.
✓
Credentials
Only one credential (BESTYOU_API_KEY) is required and is the declared primary credential, which is proportionate for a skill that calls the BestYou MCP API. The docs instruct storing the key in a local mcporter.json Authorization Bearer header — convenient but means the key will be present in plaintext on disk at the specified path, so users should ensure appropriate filesystem permissions and scope.
✓
Persistence & Privilege
always:false and user-invocable:true (default). The skill does not request permanent or elevated platform privileges and does not attempt to modify other skills or system-wide settings beyond recommending a gateway restart.
Assessment
What to consider before installing: - The skill legitimately needs BESTYOU_API_KEY and uses mcporter to call the BestYou MCP service (baseUrl: https://mcp.bestyou.ai/mcp). Only provide a key you intend to use with BestYou and grant minimal scopes required. - You will be asked to store the API key in a local config file (~/.openclaw/workspace/config/mcporter.json). That file contains the Bearer token in plaintext; secure the file (restrict permissions) and delete or rotate the key if you stop using the skill. - The skill recommends installing mcporter globally via npm. Verify the mcporter package name, publisher, and version before running `npm install -g`, or prefer a local install (or pinned version) if you have concerns about global packages. - The HTML templates load images from cdn.bestyou.ai and fonts from fonts.googleapis.com — loading templates will cause outbound requests to those CDNs (normal for rendering images/fonts but note this leaks that the client retrieved those assets). - Review references/setup.md and references/security.md included in the package for any additional security recommendations the skill provides. - If you have doubts, test in an isolated environment or use a dedicated OpenClaw workspace account/key so you can revoke or rotate the key without impacting other integrations.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ehkv9fdb11966m0f2g0y91s83d6db

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvBESTYOU_API_KEY
Primary envBESTYOU_API_KEY

Comments