Skill Health

Analyze wearable health CSV exports (steps, heart rate, sleep, calories, SpO2, exercise, distance) and produce compact JSON reports for hourly, daily, weekly...

This skill appears coherent and focused: it reads local wearable exports and emits JSON reports. Before installing or running it: (1) run in an isolated environment (virtualenv/container) and install Python 3.10+ and pandas; (2) review the remaining omitted files (12 files were not shown in the prompt) if you want maximum assurance; (3) treat output and inputs as sensitive health data—do not upload them to external services unless intended; (4) if you do not want the agent to invoke skills autonomously, adjust the agent/skill invocation settings. Running the scripts on a small sample dataset in a sandbox is a good first test.

Type: OpenClaw Skill Name: skill-health Version: 1.0.1 The skill is classified as suspicious due to path traversal vulnerabilities in all `scripts/run_*.py` files. Specifically, the `--output-dir` argument allows writing generated JSON reports to arbitrary file system paths, potentially leading to unauthorized file creation or overwrites (e.g., `/etc/passwd`, `~/.ssh/authorized_keys`). Similarly, the `--data-path` and `--data-dir` arguments allow reading CSV data from arbitrary file system paths, enabling an attacker to instruct the agent to read sensitive files (e.g., `/etc/shadow`) even if they fail to parse as valid health data CSVs. These are critical vulnerabilities that could be exploited by prompt injection against the agent, but there is no evidence of intentional malicious behavior within the code itself.