Coach Skill

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 91d3941b67daeea047b5bcb417fad6b89931fc63717bea833f9e39e20239ee3a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is classified as benign. Its purpose is to create personalized training plans, which involves interacting with the user to gather fitness data, optionally connecting to Strava, analyzing data from a local SQLite database (`~/.claude-coach/coach.db`), and generating an HTML plan. All commands (`npx claude-coach auth`, `npx claude-coach sync`, `npx claude-coach query`, `npx claude-coach render`) are executed locally and are directly related to the skill's stated functionality. While the skill requests sensitive Strava API credentials, this is explicitly communicated to the user for the purpose of Strava integration. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence, obfuscation, or prompt injection attempts designed to subvert the agent's core purpose or access unrelated sensitive data.