Hevy
v1.0.1Interact with the Hevy fitness app via the hevy-cli command-line tool. Use when the user wants to view, create, or update workouts, routines, exercise templates, or routine folders in their Hevy account. Triggers on requests involving workout tracking, exercise history, routine management, or any Hevy-related data operations.
⭐ 0· 859·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md clearly expects the 'hevy' CLI and an HEVY_API_KEY environment variable (or --api-key flag) to interact with a Hevy account, but the registry metadata declares no required binaries and no required env vars. A Hevy integration legitimately needs an API key and the CLI binary; the metadata omission is an incoherence that could hide missing permissions or setup expectations.
Instruction Scope
The runtime instructions stay on-topic (list/create/update workouts, routines, templates). They instruct use of --exercises-json @filepath, which is normal for this tool but also enables sending file contents to the remote API if a filepath is provided. The instructions do not ask for unrelated files or credentials, but they assume the agent or user will supply file paths and the 'hevy' binary.
Install Mechanism
There is no install spec (instruction-only), which is lower risk, but the skill implicitly requires an external 'hevy' CLI binary to be present on PATH. The metadata does not declare this requirement; users should confirm how the CLI will be provided/installed before use.
Credentials
Functionality reasonably requires an HEVY_API_KEY (and the docs state it), but the skill's declared required env vars and primary credential are empty. That mismatch is a red flag — the skill will need a secret credential to function but the registry entry does not advertise it, preventing informed permission decisions.
Persistence & Privilege
The skill does not request always: true and does not appear to modify other skills or system-wide settings. It will run only when invoked or when the agent chooses to call it (default model invocation allowed).
What to consider before installing
Do not install blindly. Confirm the source and homepage of this skill (none provided). Ask the publisher to: (1) declare that the 'hevy' CLI binary is required, (2) list HEVY_API_KEY as a required credential in the metadata, and (3) explain how the CLI will be installed or supplied. If you proceed, only provide a Hevy API key you trust and avoid using @filepath arguments that could cause the agent/CLI to read and transmit sensitive local files. If you cannot verify the publisher, prefer a skill with a known source or one that uses an official API integration with clear metadata.Like a lobster shell, security has layers — review code before you run it.
latestvk97dc855mq85xx9v59j4ewbg2n80xbxg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.