Fitbit Health Skill

• Analyzed: May 14, 2026, 3:06 AM
• Findings: 1
• Version: 0.1.1
• Hash: 8bac76f533745119c733b35c8d72160096ceb2bad1a3d8bf5d69cf3937e7d507
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Fitbit is benign. The code and documentation clearly align with its stated purpose of querying Fitbit health data via a CLI. It implements a standard OAuth 2.0 PKCE flow, storing tokens securely in `~/.config/fitbit-cli/tokens.json` with `0o600` permissions, and all network communication is directed to legitimate Fitbit API endpoints. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent in `SKILL.md` or `README.md`. Dependencies listed in `package.json` are standard and widely used for CLI development.