ClawHub

FitnessRec FitAPI

v1.1.6

Precise food & exercise data for AI agents — not LLM guesses. 16k foods (180 nutrients from USDA/NUTTAB/CNF2015/MEXT/FRIDA), 3M branded products with barcode...

⭐ 1· 178·0 current·0 all-time
by@emreakkoc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (food/exercise database) match the declared endpoints and the single required credential (apiKey). The skill asks only for access to the FitAPI service and documents the signup/dashboard URL. Minor metadata mismatch: skill.yaml version is 1.1.5 while registry metadata lists 1.1.6, but this is likely bookkeeping.
✓
Instruction Scope
SKILL.md instructs only how to call the listed FitAPI endpoints and how to obtain/configure the API key; it does not ask for unrelated files, system paths, or other environment variables. Some endpoint choices (e.g., POST for resource lookups like /foods/{id}) are unusual but are an implementation detail rather than a scope creep.
✓
Install Mechanism
No install spec and no included code files — instruction-only skill — so nothing is written to disk or downloaded during install. This is the lowest-risk install model.
✓
Credentials
Only a single credential (apiKey) is required via config.schema.json, which is appropriate for an external API. There are no unrelated secrets, credential requests, or config path accesses.
✓
Persistence & Privilege
always:false and default model-invocation are used (normal). The skill declares network permission (expected for an API-backed skill). It does not request persistent system-wide privileges or modify other skills.
Assessment
This skill appears to be a straightforward API wrapper. Before installing: verify the domain (https://fitapi.fitnessrec.com) is correct and legitimate, review FitnessRec's privacy/security docs and terms, and sign up for a free/limited API key first so exposure is minimal. Be aware that the agent will use your API key to make network calls to the FitAPI domain — do not provide other credentials or sensitive personal data unless you trust the service. If you later want to stop access, revoke the API key from the FitAPI dashboard. If you need higher assurance, contact the listed support email (support@fitnessrec.com) or test with a throwaway key on the free tier.

Like a lobster shell, security has layers — review code before you run it.

barcodevk972z0t937f6gw6em52nz1x4en84r083exercisevk972z0t937f6gw6em52nz1x4en84r083fitapivk972z0t937f6gw6em52nz1x4en84r083fitnessvk972z0t937f6gw6em52nz1x4en84r083fitnessrecvk972z0t937f6gw6em52nz1x4en84r083foodvk972z0t937f6gw6em52nz1x4en84r083latestvk972z0t937f6gw6em52nz1x4en84r083nutritionvk972z0t937f6gw6em52nz1x4en84r083recipesvk972z0t937f6gw6em52nz1x4en84r083

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments