Bmi Tracker

BMI 追踪 - BMI 计算、健康评估、改善建议

Security Scan

The skill's instructions are simple and match a BMI tracker, but metadata and packaging references are inconsistent (missing declared runtime dependency on the clawhub CLI and a contradictory requires entry for curl), which warrants caution before installing.

Purpose & Capability

The name/description (BMI calculation, assessment, history, goals) match the runtime commands shown in SKILL.md. However, SKILL.md expects a 'clawhub' CLI to be present while the registry metadata lists no required binaries; _meta.json lists curl as a required binary. These mismatches mean the declared requirements do not fully align with what the skill actually needs to operate.

Instruction Scope

SKILL.md only instructs running local CLI commands (clawhub bmi calc/assess/history/goal). It does not ask the agent to read unrelated files, access environment variables, or transmit data to external endpoints beyond what the clawhub CLI might do. The instructions themselves stay within the stated BMI-tracker purpose.

Install Mechanism

There is no formal install spec in the registry (instruction-only), which is low-risk. README suggests using 'npx clawhub@latest install bmi-tracker' (which would fetch code from npm at install time). That user-facing install hint is not codified in the skill spec, creating ambiguity about where and how code will be obtained if followed.

Credentials

The skill does not request any environment variables, credentials, or config paths. There are no indications it needs secrets or broad access. The only proportionality concern is the unexplained 'curl' requirement in _meta.json, which is not justified by the SKILL.md content.

Persistence & Privilege

The skill is not always-enabled and does not claim the ability to modify other skills or system settings. It appears to be user-invocable only, which is appropriate for this utility.

Scan Findings in Context

[meta_requires_curl] unexpected: _meta.json contains requires: ["curl"], but SKILL.md shows only 'clawhub' CLI usage and the registry's 'required binaries' field reports none. Requiring curl is not obviously necessary for a purely local BMI CLI unless the underlying clawhub implementation or install process uses curl.

What to consider before installing

This skill appears to do what it says (BMI calculations and tracking), but there are inconsistencies you should resolve before installing or running it: (1) SKILL.md expects a 'clawhub' CLI — confirm you have or trust that tool; the skill spec does not declare that dependency. (2) _meta.json lists curl as required even though the instructions don't use it — ask the publisher why. (3) README suggests installing via 'npx', which will fetch packages from the network; only proceed if you trust the source and prefer fetching code at install time. If you need to be cautious: ask the author for a canonical install/usage guide or inspect the actual npm package (or run in a sandbox/vm) before installing on a production machine.

BMI 追踪工具，帮你管理健康体重。

功能

• ✅ BMI 计算
• ✅ 健康评估
• ✅ 改善建议
• ✅ 历史记录
• ✅ 目标设定

使用

# 计算 BMI
clawhub bmi calc --height 175 --weight 70

# 健康评估
clawhub bmi assess --bmi 22.8

# 查看历史
clawhub bmi history

# 目标设定
clawhub bmi goal --target 22

定价

版本	价格	功能
免费版	¥0	基础功能
Pro 版	¥19	全部功能
订阅版	¥4/月	Pro+ AI 建议