Fitbit Analytics

This skill appears to implement Fitbit API access and reporting as described, but review the following before installing: - The code will read from and write to ~/.config/systemd/user/secrets.conf (and will create ~/.fitbit-analytics/tokens.json). If you run it, it will attempt to persist refreshed access/refresh tokens into that secrets.conf file and set file permissions. Ensure that file is not used for unrelated secrets you don't want overwritten. - If you prefer not to have tokens persisted to that shared secrets file, run scripts with explicit env vars (export FITBIT_ACCESS_TOKEN and FITBIT_REFRESH_TOKEN) or modify the code to use a dedicated secrets file. Inspect scripts/fitbit_api.py to confirm exactly what will be written. - The skill contacts only Fitbit endpoints (api.fitbit.com) for data and dev.fitbit.com for setup — there are no other remote endpoints in the code. Still, review the files yourself before granting client_secret/refresh token access. - Limit the permissions of the Fitbit app to only the scopes you need. Treat client_secret and refresh token as sensitive: store them in a dedicated, secure secrets store if possible. - If you are unsure, run the scripts in an isolated account or container and observe file writes (secrets.conf, ~/.fitbit-analytics) to confirm behavior before enabling automation/cron or granting persistent access.