Health Report

通过自然语言配置健康档案，主动引导录入体重、饮食、饮水、运动数据，生成专业健康报告并多端推送。

This skill appears to do what it says: read local health notes, generate a PDF report, and optionally push it to webhooks. Before installing, do the following: (1) Inspect and confirm the config/.env and config/user_config.json — do not put secrets you don't trust into webhook fields. (2) Ensure MEMORY_DIR points only to the directory with the intended health markdown files (the script will read files there). (3) If you plan to host PDF reports on a web directory, verify REPORT_WEB_DIR and REPORT_BASE_URL point to a secure location you control — otherwise sensitive reports could be exposed. (4) Install into a Python virtualenv and pin dependencies (reportlab, Pillow) rather than using system Python. (5) If you do not want automatic external pushes, leave webhook vars empty; the code will still generate local PDFs. (6) Note minor metadata inconsistencies (registry header said no env vars / no install spec while SKILL.md and _meta.json require MEMORY_DIR and list an install command); these are probably packaging oversights — consider confirming the repo/version before trusting a published copy.

Type: OpenClaw Skill Name: openclaw-skill-health-report Version: 1.0.10 The skill bundle provides a comprehensive health reporting system that reads local health records from a workspace directory and sends processed reports to external platforms (DingTalk, Feishu, Telegram). While the behavior is well-documented and aligned with the stated purpose, it exhibits several high-risk behaviors: it uses `subprocess.run` in `health_report_pro.py` to execute the `openclaw` CLI, performs external network requests to the Tavily API and various messaging webhooks, and requires access to multiple sensitive environment variables. Per the analysis criteria, the presence of shell execution and broad network/file access, even when plausibly needed for the tool's function, warrants a suspicious classification.