← 返回 Skills 市场
135
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install normieclaw-health-buddy-pro
功能描述
Stop spending 10 minutes typing out every ingredient into a clunky food logging app. Health Buddy Pro lets you snap a photo of your meal and get exact calori...
安全使用建议
Summary of what to check before installing:
- Inspect the SKILL.md and other text files in a viewer that shows hidden characters (e.g., cat -v, a hex editor) to ensure there are no concealed unicode control characters or embedded instructions. The pre-scan flagged such characters.
- Confirm how your agent's 'image' / vision tool processes images: does it run locally, or does it send images to an external API? The skill assumes local processing; if your agent forwards images to a cloud service, health photos could leave your device.
- The repo claims 'local-only' storage, which is true for the default behavior, but a dashboard-kit and Supabase/Postgres schema are included for optional cloud-backed setups. Only enable cloud sync/backups if you understand and trust the remote service and supply credentials consciously.
- Review scripts/health-buddy-init.sh before running. It enforces secure permissions and symlink checks, but its workspace detection is simplistic — run it from the intended workspace root or inspect where it will create files.
- Treat the 'Codex Security Verified' audit as an author-provided statement; if you need stronger assurance, run the skill in a sandboxed environment (or inspect network activity) to confirm it makes no outbound connections.
If any of the above checks raise doubts, prefer running the skill in an isolated/sandbox workspace or decline installation until you can verify hidden characters and the image-processing behavior.
功能分析
Type: OpenClaw Skill
Name: normieclaw-health-buddy-pro
Version: 1.0.3
Health Buddy Pro is a comprehensive health and nutrition tracking skill that demonstrates high-quality documentation and defensive configuration. The `SKILL.md` includes explicit prompt-injection defenses, instructing the AI to treat all image-extracted text and external content as untrusted data. The setup and initialization scripts (`SETUP-PROMPT.md` and `health-buddy-init.sh`) employ security best practices, such as symlink detection to prevent directory traversal and strict file permissions (`chmod 600/700`) to ensure data remains private and local. No indicators of data exfiltration, malicious execution, or unauthorized persistence were found.
能力评估
Purpose & Capability
The skill's name/description, SKILL.md, and included script consistently implement local photo-based meal logging and local storage of logs — no credentials or external services are required by default. However, the repository also contains a dashboard-kit and SQL schema mentioning Supabase/Nollio cloud backends and 'sync' options; that creates an optional cloud integration path that contradicts the README/SECURITY.md's strong 'local-only' claim. The presence of that cloud dashboard material is plausible as an opt-in feature but is worth noting because it increases the potential blast radius if enabled.
Instruction Scope
SKILL.md instructs the agent to use vision tools to extract food items and to read/write local files under data/ (e.g., data/nutrition-log.json). The instructions include robust prompt-injection defenses and explicitly treat extracted text as data not instructions. However, the pre-scan detected prompt-injection patterns (e.g., 'ignore-previous-instructions' and 'unicode-control-chars') inside SKILL.md — while they appear to be present as examples of malicious payloads that should be ignored, their presence increases risk and should be manually inspected to ensure there are no hidden control characters or ambiguous examples that could be mis-parsed. The instructions also rely on the host agent's 'image' tool/vision capability; you should verify how that tool handles images (local vs remote processing).
Install Mechanism
There is no external install spec and the only executable is a small shell initializer (scripts/health-buddy-init.sh) that creates local data/config directories with secure permissions and refuses symlinked targets. The shell script appears to avoid writing outside the skill directory, but its workspace-root detection loop is trivial (effectively uses current directory) — meaning if run from an unexpected working directory it will create/operate under that cwd's skills/ path. No downloads, no external URLs, and no packages are installed by the skill itself.
Credentials
The skill requests no environment variables, no credentials, and no config paths beyond its own skill directory. That is proportionate to a local meal-logging skill. The only notable point is the repository's documentation for optional cloud/back-end usage (Supabase) which would require credentials if the user elects to enable it; those credentials are not required by default.
Persistence & Privilege
The skill does create and write to local files under skills/health-buddy-pro/data, which is expected for a logging tool. It does not request always:true, does not require elevated system privileges, and contains checks rejecting symlinked paths to prevent writes escaping the skill directory. It does not modify other skills' configurations in the provided files.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install normieclaw-health-buddy-pro - 安装完成后，直接呼叫该 Skill 的名称或使用
/normieclaw-health-buddy-pro触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.3
v1.0.3: Security fixes: confined scripts to skill directory, removed filesystem traversal from setup
v1.0.2
v1.0.2: MIT license, cleaned descriptions, removed cross-sell
v1.0.0
Initial publish from NormieClaw.ai — Free OpenClaw skills for everyone.
元数据
常见问题
Health Buddy Pro 是什么？
Stop spending 10 minutes typing out every ingredient into a clunky food logging app. Health Buddy Pro lets you snap a photo of your meal and get exact calori... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 135 次。
如何安装 Health Buddy Pro？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install normieclaw-health-buddy-pro」即可一键安装，无需额外配置。
Health Buddy Pro 是免费的吗？
是的，Health Buddy Pro 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Health Buddy Pro 支持哪些平台？
Health Buddy Pro 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Health Buddy Pro？
由 Nollio（@nollio）开发并维护，当前版本 v1.0.3。
推荐 Skills