功能描述

Query Fitbit health data (activity, sleep, heart rate, weight) via CLI. Use when answering health/fitness questions that require Fitbit data, or when the user asks about their steps, sleep, heart rate, or weight from Fitbit.

使用说明 (SKILL.md)

Fitbit CLI

Name: Fitbit Health Skill
Author: pb3975

Retrieve health and fitness data from Fitbit's Web API.

Setup

Register an app at https://dev.fitbit.com/apps
- OAuth 2.0 Application Type: Personal
- Callback URL: http://localhost:18787/callback
Run fitbit configure and enter your Client ID
Run fitbit login to authorize

Quick Reference

# Setup & auth
fitbit configure              # Set client ID (first time)
fitbit login                  # Authorize via browser
fitbit logout                 # Sign out
fitbit status                 # Check auth status

# Data
fitbit profile                # User profile info
fitbit activity [date]        # Daily activity summary
fitbit activity steps [date]  # Just steps
fitbit summary [date]         # Full daily summary
fitbit today                  # Today's summary (shortcut)

Options

All commands support:

--json — JSON output
--no-color — Plain text output
--verbose — Debug/HTTP details
--tz \x3Czone> — Override timezone (e.g., America/Chicago)

Examples

# Get today's step count
fitbit activity steps

# Get yesterday's full summary as JSON
fitbit summary 2026-01-25 --json

# Check if authenticated
fitbit status

Notes

Dates default to today if omitted
Date format: YYYY-MM-DD or today
Tokens are stored in ~/.config/fitbit-cli/tokens.json (chmod 600)
Token refresh is automatic

安全使用建议

This skill appears to do what it says: it performs OAuth (PKCE) with Fitbit, stores tokens locally (~/.config/fitbit-cli/tokens.json, chmod 600), and only calls Fitbit endpoints. Before installing, confirm you obtain the 'fitbit' CLI from a trusted source (the repository/package listed), supply your own Fitbit Client ID via dev.fitbit.com, and review the token/config files if you want to audit stored credentials. If you later want to revoke access, run the CLI's logout or revoke the app from your Fitbit account. If you prefer not to allow autonomous agent invocation, ensure your agent's policy restricts or prompts before calling external skills.

功能分析

Type: OpenClaw Skill Name: fitbit-health Version: 0.1.1 The OpenClaw AgentSkills skill bundle for Fitbit is benign. The code and documentation clearly align with its stated purpose of querying Fitbit health data via a CLI. It implements a standard OAuth 2.0 PKCE flow, storing tokens securely in `~/.config/fitbit-cli/tokens.json` with `0o600` permissions, and all network communication is directed to legitimate Fitbit API endpoints. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent in `SKILL.md` or `README.md`. Dependencies listed in `package.json` are standard and widely used for CLI development.

能力评估

✓ Purpose & Capability

Name, description, SKILL.md, and code all align: the skill is a CLI for Fitbit data and explicitly requires a 'fitbit' binary. No unrelated services, env vars, or binaries are requested.

✓ Instruction Scope

Runtime instructions are limited to registering a Fitbit app, running the CLI's configure/login commands, and reading/writing config and token files under ~/.config/fitbit-cli. The code only contacts Fitbit endpoints (api.fitbit.com and www.fitbit.com) and uses a local 127.0.0.1 callback for OAuth.

✓ Install Mechanism

There is no provided install spec in the registry (instruction-only). The included package.json shows normal npm build/dev tooling and standard dependencies; no downloads from arbitrary URLs or extract/install behavior are present.

✓ Credentials

The skill does not request environment variables or external credentials. It uses a user-provided Fitbit Client ID (configured via the CLI) and OAuth tokens stored in the user's home directory—appropriate and proportional for the stated functionality.

✓ Persistence & Privilege

The skill does not request always:true and is user-invocable. It stores tokens and config under ~/.config/fitbit-cli with file permissions set to 0600 and runs a local callback server bound to 127.0.0.1; these are standard for an OAuth CLI and do not indicate excessive privilege.

版本历史

v0.1.1

Initial release: OAuth PKCE auth, activity/profile/summary commands

元数据

Slug fitbit-health

版本 0.1.1

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题

Fitbit Health Skill 是什么？

Query Fitbit health data (activity, sleep, heart rate, weight) via CLI. Use when answering health/fitness questions that require Fitbit data, or when the user asks about their steps, sleep, heart rate, or weight from Fitbit. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1803 次。

如何安装 Fitbit Health Skill？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install fitbit-health」即可一键安装，无需额外配置。

Fitbit Health Skill 是免费的吗？

是的，Fitbit Health Skill 完全免费（开源免费），可自由下载、安装和使用。

Fitbit Health Skill 支持哪些平台？

Fitbit Health Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Fitbit Health Skill？

由 pb3975（@pb3975）开发并维护，当前版本 v0.1.1。

Fitbit Health Skill