Running Coach
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to do what it says—generate running plans and sync them to Intervals.icu—but it uses an API key and can write workouts to your account.
Install only if you are comfortable giving it an Intervals.icu API key to create workout events. Prefer environment variables over editing config.json, run a dry run first, verify the generated plan before upload, and revoke/regenerate the API key if it is exposed or no longer needed.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you provide the API key, the skill can act on the configured Intervals.icu athlete account within the API operations it performs.
The script uses the configured Intervals.icu API key for authenticated API calls, which is expected for syncing workouts but gives the skill delegated access to that account.
auth_string = f"API_KEY:{CONFIG['API_KEY']}"; req.add_header("Authorization", f"Basic {auth_b64}")Use a dedicated/revocable Intervals.icu API key if possible, keep it out of shared chats and repositories, verify the athlete ID, and regenerate the key if you stop using the skill.
Running the upload path can add planned workouts to your Intervals.icu calendar.
The helper creates workout events in Intervals.icu via POST. This matches the skill purpose, but it is still an account-writing action.
url = f"{BASE_URL}/athlete/{CONFIG['ATHLETE_ID']}/events?upsertOnUid=true" ... return make_request("POST", url, data)Review generated workouts first, use --dry-run before the first real upload, and confirm dates, paces, distances, and athlete ID before allowing uploads.
The registry summary may understate the setup credentials needed for the skill to work.
The registry metadata says no credentials or env vars are declared, while the included skill documentation and _meta.json describe INTERVALS_API_KEY and INTERVALS_ATHLETE_ID.
Required env vars: none; Env var declarations: none; Primary credential: none
Treat the skill as requiring Intervals.icu credentials despite the registry metadata, and review SKILL.md/_meta.json before installation.