Withings Family

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 1.1.2
• Hash: 2035cc0ec7821ec409135d86e68ca5a13a130262ef37c7e9dbaaf56cca868a7d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw Withings Family skill is benign. It securely handles OAuth authentication with Withings API, including robust user ID sanitization to prevent path traversal for token files, secure file permissions (0o600) for sensitive tokens, and CSRF protection using a 'state' parameter during the OAuth flow. All network communication is directed to legitimate Withings API endpoints, and there is no evidence of data exfiltration to unauthorized destinations, malicious command execution, persistence mechanisms, or prompt injection attempts in the SKILL.md documentation. The code's functionality is entirely aligned with its stated purpose of fetching health data.