🌟 Your personal Garmin & AI health coach. Analyze sleep and biometric data daily for actionable functional medicine insights.

This skill is internally consistent for a Garmin-based health coach, but pay special attention to privacy: it sends your wearable metrics and history to NotebookLM (Google) via the notebooklm CLI, despite marketing language that suggests 'local-only' analysis. Before installing or running: 1) Decide whether you are comfortable sending health metrics to Google/NotebookLM; review NotebookLM's privacy policy. 2) Inspect and run the included install.sh in a safe/isolated environment (e.g., a disposable VM) because it will pip install packages and download a Chromium browser. 3) Note that garth stores Garmin session tokens in ~/.garth — protect that directory and verify its contents. 4) The skill stores config and history under ~/.openclaw/data/health-assistant (config.json set to 0o600), but the user email is stored in plain text and health records are kept locally for 30 days; consider whether that storage location meets your privacy requirements. 5) If you require strictly local analysis, do not authenticate NotebookLM (or replace NotebookLM with a local LLM); otherwise assume your prompts and health metrics will be transmitted to Google. 6) If you want higher assurance, have a developer review the code and verify network calls (or run in a network-restricted sandbox) before linking real accounts.

Type: OpenClaw Skill Name: health-coach Version: 1.0.1 The health-assistant skill bundle is a legitimate tool designed to analyze Garmin wearable data using Google's NotebookLM. The code demonstrates high security awareness, specifically in src/report_generator.py, where it uses restricted-permission temporary files (0o600) and stdin pipes to pass data to subprocesses, preventing sensitive health data from appearing in system process lists. Authentication is handled through external official CLI tools (garth and notebooklm-py), ensuring the skill itself does not manage user passwords directly. No indicators of data exfiltration, malicious prompt injection, or unauthorized persistence were found.