Run Coach

Science-based running coach with HD visual training plans and Garmin sync. For all runners — from 5K fitness to marathon.

What to consider before installing: - The skill requires a Telegram bot token (TELEGRAM_BOT_TOKEN). Anyone with that token can control your bot, so create a dedicated bot and keep the token private. Use a dedicated chat id or account for the bot to minimize exposure. - Garmin integration is optional but requires GARMIN_EMAIL and GARMIN_PASSWORD; if you enable it the unofficial garminconnect library will be used and a session token file (garmin/.garth) will be stored on disk. Only provide Garmin credentials if you understand and accept this risk (and consider revoking passwords or tokens afterwards). - The skill runs local scripts (bash + Node + Python). That means code included in the skill will execute on the host when you ask the agent to render/send images or sync Garmin data — run it in an isolated container or environment you control (not on a shared host) if you have concerns. - The SKILL.md tells you to install system packages (fonts, Playwright Chromium) if you want the HD image pipeline. Those are user-run steps — validate them and prefer isolated environments. - If you want extra caution: inspect the scripts locally, create a dedicated Telegram bot and user account for this skill, avoid storing highly privileged or reuseable secrets in global envs, and only run garmin-sync when needed. If anything about the skill's behavior is unexpected, stop and inspect the garmin/ and training/ directories and the contents of the files written there.

Type: OpenClaw Skill Name: run-coach Version: 1.0.7 The 'run-coach' skill is a legitimate tool for tracking running activities and generating visual training plans. It uses the official Telegram Bot API and the 'garminconnect' library to sync user data, with all sensitive credentials (tokens and passwords) managed via environment variables as per standard OpenClaw practices. The code logic in 'training/text-to-image.sh' and 'training/screenshot.mjs' is transparent, focusing on rendering HTML to images using Playwright, and lacks any indicators of data exfiltration, persistence, or malicious intent.