FitBuddy
v2.1.1专属健身追踪与饮食记录助手。支持体重/饮食/运动/饮水记录、BMR/TDEE自动计算、碳循环等饮食策略、食物数据库自动计算营养素、营养知识问答、训练计划制定、趋势图表、定时提醒。触发词：记录饮食/体重/运动/饮水、健身打卡/设置/初始化、今天吃了/练了、查看进度、训练建议、喝水了吗、蛋白质/碳水/脂肪/热量相关、...
⭐ 0· 87·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (fitness tracking, logging, reminders, nutrition) matches the provided scripts, data files, and reference docs. Optional McDonald's MCP integration is documented and justified by the feature; no unrelated credentials or services are required by default.
Instruction Scope
SKILL.md instructs the agent to read and update local files under skills/fitbuddy/fitbuddy-data/, run included Python scripts (calc.py, record.py, chart.py, init_profile.py) and create cron reminders. Those operations are within the stated purpose; the skill does not instruct broad system inspection or exfiltration of unrelated data. The only external interactions are optional channel integrations (mcporter/MCP, DingTalk/WeChat) described for sending reminders.
Install Mechanism
No install spec is provided (instruction-only with bundled scripts). That is low-risk; included Python scripts run locally and require Python/matplotlib as documented. There are no downloads from arbitrary URLs or package installs embedded in the skill packaging itself.
Credentials
The skill declares no required environment variables or primary credential. Optional integrations (McDonald's MCP, DingTalk MCP) require user-supplied tokens/configuration and are explicitly documented as opt-in. No secret is required by default, and the documentation explains where tokens would be stored if the user enables integration.
Persistence & Privilege
The skill creates cron reminders (OpenClaw cron) and writes/reads data under its own skills/fitbuddy/fitbuddy-data/ directory (profile.json, records, food-db). This is consistent with reminder and tracking functionality but does mean the skill will persist data locally and may create scheduled tasks — users should review and approve cron creation and any gateway/device pairing steps.
Assessment
This skill appears coherent with its stated purpose. Before installing: (1) Review the bundled scripts (especially record.py) to verify you are comfortable with local file writes under skills/fitbuddy/fitbuddy-data/ (profile.json and records/). (2) Be aware the skill may create OpenClaw cron tasks to send reminders; creating/removing cron tasks can require gateway/device permissions — approve only if you trust the skill and understand pairing implications. (3) Optional McDonald's/DingTalk integrations require you to add tokens/config (mcporter or mcporter.json); these are opt-in. If you enable them, store tokens securely and confirm promo/auto-claim features remain off (they default to OFF). (4) If you want minimal surface, do not enable external channel integrations and keep reminders disabled or manually configured. If you want higher assurance, run the skill in a sandboxed agent instance and inspect the created cron tasks and config files after initialization.Like a lobster shell, security has layers — review code before you run it.
latestvk97737f0eqrjeczghmx98rfty184qhyv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.