Strava Cycling Coach

Track and analyze cycling performance from Strava. Use when analyzing ride data, reviewing fitness trends, understanding workout performance, or providing insights on cycling training. Automatically monitors new rides and provides performance analysis.

This skill appears to do what it claims: it connects to Strava, stores the OAuth client ID/secret and tokens in ~/.config/strava/config.json, caches activities in ~/.cache/strava, and can be scheduled by cron. Before installing or running it: 1) Review the bundled scripts yourself (they are included) and verify network calls are only to Strava (https://www.strava.com). 2) Note the README/SKILL.md refer to a few non-existent filenames (e.g., analyze_ride.py, monitor_rides.sh) — use the actual scripts in the repo (analyze_and_notify.py, monitor_new_rides.py, etc.) or fix the docs. 3) If you expect Telegram notifications, inspect/modify send_telegram_message to use the real Telegram API or your messaging tooling; currently it prints the message and assumes a 'Clawdbot' message tool. 4) Keep your client_secret and saved tokens protected (the setup script sets 0o600 but verify). 5) If you plan to add the cron job, prefer using an absolute path to the script (not relying on $(pwd)) and review the crontab changes before applying. If you want more assurance, run the scripts in an isolated environment (different user account or container) the first time and monitor outbound traffic.

Type: OpenClaw Skill Name: strava-cycling-coach Version: 1.0.0 The skill is classified as suspicious due to its use of persistence mechanisms. The `SKILL.md` file explicitly instructs the user to modify `~/.bashrc` to export an environment variable and to set up a cron job using `crontab` for automatic monitoring. While these actions are documented and aligned with the stated purpose of the skill (automatic ride analysis and notifications), modifying user shell profiles and system cron tables constitutes a meaningful high-risk behavior and a form of persistence, which elevates it beyond a benign classification. All network communication is legitimately directed to the Strava API, and there is no evidence of data exfiltration to unauthorized endpoints or malicious prompt injection against the agent.