Runstr analytics

Advanced RUNSTR fitness analytics with trend analysis, performance insights, training recommendations, and correlation tracking. Analyzes workout history, ha...

This skill does what it says (fetch and analyze RUNSTR backups), but there are important inconsistencies and secret-handling risks you should address before installing: - Do not paste your Nostr private key (nsec1...) into a chat message. The SKILL.md suggests doing this, which risks the key being stored or transmitted by the agent. Prefer supplying secrets only via secure 1) environment variables, 2) stdin, or 3) temporary files with strict permissions — but see next points. - The README claims the key is passed via stdin to avoid exposure, but multiple scripts (analyze.py, analyze_light.py, daily_update.sh) pass the nsec on the command line or forward it as a --nsec argument, which exposes it in process listings (ps) and to other system monitoring. If you plan to use this, inspect and modify the code so all calls use stdin (the extended script already does this) or other safe mechanisms. - The registry metadata at the top is inconsistent: it lists no required env vars, but _meta.json and SKILL.md require RUNSTR_NSEC. Treat RUNSTR_NSEC as required and verify how you will store/enter it. Avoid putting secrets in crontab or plain-text startup files. Cron jobs typically do not inherit your interactive environment; storing the key in files that cron reads will persist the secret — consider using a secure secret manager or run the job from a user-level systemd service with restricted environment instead. - The install steps use a Go package to install 'nak' (github.com/fiatjaf/nak) and pip for analytics libs — confirm you trust those sources. 'nak' is necessary to read/decrypt Nostr data, but installing arbitrary CLI tools should be done from trusted releases. - If you want to proceed: (1) prefer running the extended script which uses stdin for nak.decode; (2) edit analyze.py and analyze_light.py to use stdin for secret input; (3) avoid pasting secrets into chat and avoid placing RUNSTR_NSEC in crontab or unencrypted files; (4) ensure the cache location is on encrypted disk if you are concerned about local data disclosure. If you are not comfortable auditing or modifying the scripts, treat this skill as risky and consider not installing it.

Type: OpenClaw Skill Name: runstr-analytics Version: 1.0.1 The skill handles highly sensitive Nostr private keys (nsec) and decrypted personal fitness/journal data, which are high-risk behaviors. While the documentation in SKILL.md and scripts/analyze_extended.py claims to handle the nsec securely via stdin to prevent exposure in process lists, the implementation actually accepts the nsec as a command-line argument in all Python scripts and the daily_update.sh script, creating a significant information exposure vulnerability. Additionally, the skill lists 'requests' as a dependency in _meta.json and SKILL.md but never utilizes it in the code, and it sets up persistence via a cron job (setup_cron.sh) to automate data fetching and local caching in a SQLite database.