ovulation-tracking

AI-powered fertility tracking with personalized temperature pattern detection and multi-signal fusion. Learns YOUR unique ovulation pattern over 2-3 cycles f...

This package appears to implement the fertility-tracking features described, but review these before installing: - Data flow: The docs promise "local processing" but also describe using Oura Cloud, Open-Meteo, and sending partner emails. Confirm whether the instance will contact external APIs (Oura/Open-Meteo/SMTP) in your deployment and whether you accept that network traffic. - Secrets in config: The example shows storing Oura tokens and an email password in config.json. Avoid storing plaintext credentials in files that other users/processes can read; prefer platform secrets, file-protected token stores, or per-skill env vars. - Unimplemented / advertised features: Photo-based LH-strip analysis, automatic email sending, and some integrations are advertised but left as TODOs in code. If you rely on those features, verify their actual implementation and where image data would be uploaded or processed. - Privacy: The skill records intimate health data and may transmit alerts/photos to third parties (partner). If you enable partner alerts or photo uploads, confirm recipient addresses and that you consent to sending such data externally. - Cross-skill calls: The skill references an ouraSkill API. If you wire it to other agent skills, review permissions and ensure only the intended data is shared across skills. If you want to proceed: run the code in a sandbox, inspect network calls (or run offline), and avoid populating config.json with sensitive credentials until you’ve verified where and how they’re used.

Type: OpenClaw Skill Name: ovulation-tracking Version: 1.0.0 The skill bundle implements a comprehensive fertility tracking system that integrates Oura Ring biometric data with manual inputs (LH tests, symptoms) to predict ovulation. The code in index.js and v2/index.js follows the documented features, using Bayesian fusion and pattern detection logic. While the loadToken function in index.js contains a potential vulnerability by allowing arbitrary file reads via a 'file:' prefix in the configuration, this is a common pattern for local secret management and lacks evidence of malicious intent. No data exfiltration, unauthorized network calls, or prompt injection attacks were identified.