onelap sync strava

因为顽鹿在 2026 年 3 月关闭了自动同步 Strava 的功能，这个SKILL专门用来帮你把顽鹿运动的骑行记录顺畅地同步到 Strava。

This skill is an instructions-only helper to run a third-party program that syncs Onelap to Strava. Before using it: 1) Verify the GitHub repository and its author (review code or build from source if you can) rather than blindly running a downloaded binary; 2) Prefer building locally or checking release checksums/signatures; 3) Do not paste credentials into chat—enter them into the local config.json and restrict its file permissions (chmod 600); 4) Create a dedicated Strava API app for this use and avoid reusing high-privilege secrets; 5) Be cautious when downloading artifacts from GitHub Actions (prefer official releases); 6) Note the registry metadata didn’t list the required binary/config items — confirm those files exist before running. If you cannot verify the binary/source, do not run it on a machine with sensitive accounts.

Type: OpenClaw Skill Name: onelap-sync-strava Version: 1.0.5 The skill requires users to provide sensitive credentials, including a plaintext Onelap password and Strava API secrets, within a 'config.json' file to be processed by an external binary (OnelapSyncStrava). While the stated goal of syncing fitness data is plausible, the requirement for direct password input and the execution of third-party binaries from a GitHub repository (kermit-r-wood/OnelapSyncStrava) represent high-risk patterns for credential theft and unauthorized execution, though no explicit malicious intent is proven in the documentation.