Test Skill Xyz999

Connect your iPhone/Apple Watch Apple Health data to OpenClaw via a local webhook to analyze recovery, detect anomalies, and get health alerts.

Before installing or running this skill: - Do not run `npx healthclaw-webhook-server` unless you inspect the package source and trust its maintainer. npx will fetch and execute code from npm at runtime. - The SKILL.md references ADMIN_TOKEN and other environment variables but the registry declared none — treat admin tokens and stored pairing tokens as sensitive secrets; ensure they are generated and stored securely, and rotate them if you suspect they were exposed. - Exposing your webhook to the public internet (Tailscale Funnel / cloudflared / ngrok) is necessary for mobile sync but increases risk. Prefer Tailscale Funnel (as suggested) or verify TLS and access controls; avoid exposing the server without authentication. - Verify the iOS app provenance (TestFlight/App Store listing and developer identity) before pairing — you will be accepting data from that app. - Review where notifications go (Discord/webhook) and confirm any notification credentials are stored and used safely. - Prefer running the server on a throwaway machine or in an isolated environment until you can audit the upstream package. If possible, request an upstream repository, release hashes, or vendor the code so you can audit it before executing. If you cannot inspect and trust the webhook package and the iOS app, treat this skill as high-risk and do not expose sensitive health data to it.

Type: OpenClaw Skill Name: test-skill-xyz999 Version: 1.0.0 The HealthClaw skill is a well-documented tool designed to integrate Apple Health data with an OpenClaw agent via a local webhook server and an iOS companion app. The skill instructions (SKILL.md) and example task prompts (health-alerts.md, recovery-score.md) are clearly aligned with the stated purpose of calculating health metrics and recovery scores. While the setup involves potentially risky actions such as exposing a local port to the internet via Tailscale or Cloudflare tunnels and running a server via npx, these are transparently documented as requirements for data synchronization and are intended to be performed by the user, not autonomously or stealthily by the agent.