Workout Track

Log a strength training session and insert it into the life_db database. Use when the user shares their gym session, exercises, sets, reps, weights, RPE, res...

This skill appears to do what it says (insert workouts into a PostgreSQL DB), but it has a few operational and safety issues you should address before installing: (1) It expects DB credentials in ~/.openclaw/services/life-db/.env but the skill metadata doesn't declare required env vars — verify that file exists, contains only the DB credentials needed, and is readable only by you (chmod 600). (2) The SKILL.md runs a bash -c command embedding the JSON payload directly; make sure the agent or integrator correctly shell-escapes JSON (prefer safer approaches like passing JSON on stdin or using a direct process invocation). Without proper escaping, malformed input could lead to command injection. (3) The included Python script requires psycopg2 (and Python); ensure the runtime has those dependencies installed from trusted sources. (4) Test against a non-production or throwaway database first to confirm behavior and avoid accidental data loss. If you need this skill, ask the author to (a) declare required env vars in the metadata, (b) provide a safe invocation that does not inline raw JSON into a shell command, and (c) include explicit dependency/install instructions for psycopg2/Python runtime.

Type: OpenClaw Skill Name: workout-track Version: 1.0.2 The skill facilitates logging workout data into a PostgreSQL database but is classified as suspicious due to a potential shell injection vulnerability. The `SKILL.md` instructions direct the agent to use `bash -c` to execute a Python script with a JSON payload, a high-risk pattern that relies entirely on the agent's ability to properly shell-escape user-influenced data. Additionally, the workflow involves sourcing sensitive database credentials from a local `.env` file. While the Python script (`scripts/insert_workout.py`) itself is well-implemented with parameterized SQL queries to prevent SQL injection, the integration method via the `exec` tool introduces unnecessary risk.