Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

fitconverter

v1.0.2

运动健康转换工具。华为、Zepp、小米、vivo、三星、Keep、悦跑圈、RQrun、动动、行者运动记录导出后,可通过运动健康转换工具转换成fit、tcx、gpx、kml格式文件同步导入高驰、佳明、RQrun、Strava等主流运动平。 运动记录转换工具、运动记忆、运动数据转换、fitconverter、华为运动...

0· 91·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for daozhao/fitconverter.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "fitconverter" (daozhao/fitconverter) from ClawHub.
Skill page: https://clawhub.ai/daozhao/fitconverter
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: mcporter
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install fitconverter

ClawHub CLI

Package manager switcher

npx clawhub@latest install fitconverter
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the instructions: the skill calls an external FitConverter MCP/HTTP API to convert exercise files. It legitimately requires the mcporter CLI and an API key (FITCONVERTER_MCP_KEY). Minor inconsistency: the SKILL.md instructs editing ~/.mcporter/mcporter.json (a config path) but the registry metadata lists no required config paths.
!
Instruction Scope
Runtime instructions explicitly ask the agent to collect sensitive secrets from the user (the FitConverter API Key via chat) and accept source-account/password for some sync types. It also instructs uploading potentially sensitive zip files to api.fitconverter.com and sending payment QR images via a messaging tool. These actions are within the declared conversion purpose, but asking users to paste secrets into chat and instructing the agent to configure mcporter automatically are privacy-sensitive and grant the agent authority to handle secrets.
Install Mechanism
Instruction-only skill with no install spec and no code files — low install risk. It does require the external binary mcporter to be present, which aligns with the documented mcporter calls.
Credentials
The primary credential FITCONVERTER_MCP_KEY is declared and matches the API usage. However, the skill's instructions ask for user account/password (for certain sync modes) and to edit ~/.mcporter/mcporter.json — those are not declared as required config paths or additional environment variables. This is plausible for the service but is worth highlighting because credentials and user data will be transmitted to an external API.
Persistence & Privilege
always:false and agent invocation enabled (default) — expected. The instructions imply writing the API key into the user's mcporter config (~/.mcporter/mcporter.json), which grants persistent local configuration, but the skill metadata did not declare that config path; the skill does not request system-wide privileges or alter other skills.
What to consider before installing
This skill appears to do what it says (convert exercise data) but it asks you to share sensitive things: your FitConverter API Key and, for some syncs, your platform account/password, and to upload ZIP files that may contain personal data. Consider these before proceeding: (1) Prefer manually configuring mcporter rather than pasting API keys into chat; (2) If you must provide an API key in chat, give a constrained key you can revoke; (3) Avoid sharing platform passwords via the agent — use manual sync methods if possible; (4) Verify you trust https://www.fitconverter.com and the API endpoints before uploading files; (5) Note the metadata omission: the skill directs editing ~/.mcporter/mcporter.json but the skill did not declare that config path. If you need higher assurance, ask the publisher for source code or a documented privacy policy and a justification for any credentials requested.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🏃 Clawdis
Binsmcporter
Primary envFITCONVERTER_MCP_KEY
latestvk978eaj1j3xf4514rs06ef1qj984n6qj
91downloads
0stars
3versions
Updated 2w ago
v1.0.2
MIT-0

FitConverter 运动数据转换

通过 MCP + HTTP 协议调用 FitConverter 服务,将运动数据从一个平台转换到另一个平台。

1. 新用户必读

⚠️ 首次使用需要获取 API Key

  1. 访问 https://api.fitconverter.com/mcp/generate-api-key 获取 API Key
  2. 告诉我你的 API Key,我会帮你配置
  3. 或者手动配置 mcporter(见下文)

2. 配置 API Key

方式一:对话中配置(推荐)

直接告诉我你的 API Key:

我的 FitConverter API Key 是 fc_mcp_xxxxxx

我会自动帮你配置。

方式二:手动配置 mcporter

编辑 ~/.mcporter/mcporter.json,添加:

{
  "mcpServers": {
    "fitconverter": {
      "baseUrl": "https://api.fitconverter.com/mcp",
      "headers": {
        "Authorization": "Bearer 你的API_KEY"
      }
    }
  }
}

3. 使用方式

配置完成后,直接对话即可:

帮我把华为的运动数据转到高驰
我要把 Keep 的记录转到佳明
转换 GPX 文件到 FIT 格式

4. 支持的平台

数据源(type)

  • 文件类型:huawei, zepp, xiaomi, vivo, keep, samsung, dongdong, kml, gpx, tcx, fit
  • 同步类型:zepp_sync, keep_sync, codoon_sync, joyrun_sync, xingzhe_sync, garmin_sync_coros

目标平台(destination)

coros, garmin, strava, rqrun, huawei, keep, shuzixindong, xingzhe, igpsport, onelap, fit, tcx, gpx, kml


5. Agent 执行流程

5.1 检查配置

  1. 检查 mcporter 是否已配置 fitconverter 服务器
  2. 若未配置,引导用户访问 https://api.fitconverter.com/mcp/generate-api-key 获取 API Key

5.2 调用 MCP 工具

# 列出支持的平台
mcporter call fitconverter.list_platforms
# 查询转换状态
mcporter call fitconverter.get_conversion_status

5.3 提交转换任务

⚠️ 重要zip_file使用 multipart/form-data 上传文件(不是路径,不是Base64):

curl -X POST "https://api.fitconverter.com/mcp/submit_conversion" \
  -H "Authorization: Bearer fc_mcp_xxx" \
  -F "api_key=fc_mcp_xxx" \
  -F "type=huawei" \
  -F "destination=coros" \
  -F "address=user@example.com" \
  -F "zip_file=@/path/to/upload.zip"

Node.js 示例:

const FormData = require('form-data');
const fs = require('fs');
const https = require('https');

const form = new FormData();
form.append('api_key', 'fc_mcp_xxx');
form.append('type', 'huawei');
form.append('destination', 'coros');
form.append('address', 'user@example.com');
form.append('zip_file', fs.createReadStream('/path/to/upload.zip'));

const options = {
  hostname: 'api.fitconverter.com',
  port: 443,
  path: '/mcp/submit_conversion',
  method: 'POST',
  headers: {
    'Authorization': 'Bearer fc_mcp_xxx',
    ...form.getHeaders()
  }
};

const req = https.request(options, (res) => {
  let data = '';
  res.on('data', (chunk) => { data += chunk; });
  res.on('end', () => { console.log(data); });
});

form.pipe(req);

返回示例:

{
  "status": "payment_required",
  "order_id": "fitId_xxx",
  "qr_image_url": "https://file.fitconverter.com/qr/qr-xxx.png",
  "code_url": "weixin://wxpay/bizpayurl?pr=xxx",
  "amount": "1.00",
  "message": "需要微信支付"
}

5.4 查询转换状态

mcporter call fitconverter.get_conversion_status --args '{
  "api_key": "fc_mcp_xxx",
  "order_id": "fitId_xxx"
}'

6. 返回状态处理

status含义操作
payment_required需要支付展示二维码,引导用户支付
pending_payment等待支付中轮询 get_conversion_status
submitted提交成功告知用户等待邮件通知
error错误返回错误信息

7. 支付二维码展示

当返回 qr_image_url 时,使用 message 工具发送图片:

message({
  action: "send",
  channel: "discord",
  target: "user:用户ID",
  media: "https://file.fitconverter.com/qr/qr-xxx.png",
  caption: "请扫码支付"
})

8. 错误处理

错误解决方案
未配置 API Key引导访问 https://api.fitconverter.com/mcp/generate-api-key
不支持的数据源从支持的平台选择:huawei, keep, xiaomi 等
不支持的目标平台选择目标平台:garmin, coros, strava 等

9. API 端点

端点方法说明
/mcp/submit_conversionPOST上传文件提交转换(multipart/form-data)

10. 参数说明

提交转换(submit_conversion)

参数必填说明
api_keyAPI Key
type数据源平台
destination目标平台
address结果通知邮箱
recordMode转换模式:trial_(试用,默认)或 do(正式付费)
zip_file是*文件(文件类型必填)
account是*账号(同步类型必填)
password是*密码(同步类型必填)

* 根据数据源类型选择必填参数


11. 转换模式说明

recordMode说明费用
trial_试用模式(默认)¥0.10
do正式付费¥19.90

注意:试用模式有次数限制,正式付费可获得完整功能。


12. 完整示例

curl -X POST "https://api.fitconverter.com/mcp/submit_conversion" \
  -H "Authorization: Bearer fc_mcp_xxx" \
  -F "api_key=fc_mcp_xxx" \
  -F "type=huawei" \
  -F "destination=coros" \
  -F "address=user@example.com" \
  -F "recordMode=trial_" \
  -F "zip_file=@/path/to/upload.zip"

Comments

Loading comments...