Strava Python

Query Strava activities, stats, and workout data using Python/stravalib with interactive setup

This skill appears to be a straightforward Python Strava client and the included code implements the behavior described. Before installing: 1) Inspect SKILL.md and the two Python files yourself (or have someone you trust review them) — the pre-scan flagged hidden unicode control characters which are not expected. 2) Be aware the setup stores your client_secret, access_token, and refresh_token in plaintext at ~/.strava_credentials.json; if you proceed, restrict file permissions (chmod 600) or use a secure secrets store. 3) Verify you install the legitimate 'stravalib' package from PyPI and that you trust the skill source (the registry 'owner id' is not a public GitHub link). 4) Consider running the setup in a sandboxed environment first (or manually perform the OAuth steps via browser and paste tokens) if you are uncertain. 5) Do not paste credentials into public channels and revoke the Strava app credentials if you later suspect misuse.

Type: OpenClaw Skill Name: strava-python Version: 1.0.0 The skill bundle is classified as benign. All files, including SKILL.md and README.md, provide clear and legitimate instructions for setting up and using a Strava API client. The `setup.py` script securely prompts for Strava API credentials and stores them in a local dotfile (`~/.strava_credentials.json`) for use by `strava_control.py`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection against the AI agent, or obfuscation. The requested API scopes are appropriate for the stated purpose of querying Strava activities and stats.