Fitbit (Official API)

Official Fitbit OAuth integration for OpenClaw (Tier 1). Use to connect/authorize Fitbit, store+refresh tokens locally, fetch daily activity + sleep summarie...

This skill appears to do exactly what it claims: perform Fitbit OAuth, save tokens locally, fetch daily activity and sleep, normalize, and render a digest. Before installing/running: 1) Fix or confirm the registry metadata mismatch — the skill requires FITBIT_CLIENT_ID, FITBIT_CLIENT_SECRET, and FITBIT_REDIRECT_URI. 2) Only provide your Fitbit client_id/client_secret if you trust the code; these are sensitive and allow token exchanges. 3) Note the token file is written to ~/.config/openclaw/fitbit/token.json (or FITBIT_TOKEN_PATH) and the code attempts to chmod it to 0600; verify that location and permissions meet your security needs. 4) Loopback mode starts a local HTTP listener on 127.0.0.1 for OAuth redirects — that's normal but ensure the redirect URI is correct. 5) If unsure, review the bundled scripts locally before running; they use only standard Python libraries and communicate only with Fitbit's documented endpoints.

Type: OpenClaw Skill Name: openclaw-fitbit Version: 0.1.0 The skill bundle is a standard Fitbit API integration that implements OAuth2 authentication and data retrieval using Python's standard library. It handles sensitive credentials (tokens and client secrets) appropriately by storing them with restricted file permissions (0o600) and only communicating with official Fitbit endpoints (api.fitbit.com). No evidence of data exfiltration, malicious execution, or prompt injection was found across the scripts (fitbit_fetch_daily.py, fitbit_token.py) or documentation.