Strava Skill

Talk to your Strava data — ask questions about your activities, fitness trends, PRs, and training load using AI.

Before installing: 1) Note the SKILL.md requires a TRANSITION_API_KEY (X-API-Key) even though the registry metadata lists none — that omission is a transparency issue. 2) Only provide an API key if you trust the Transition service (https://transition.fun); verify the domain, TLS, and the service's privacy policy and terms. 3) Prefer adding the key to the agent's secret store (or skill-specific config) rather than your global shell profile. 4) Limit exposure: use a revocable key, test with a throwaway account if possible, and monitor the key's usage/requests after enabling the skill. 5) If you need stronger assurance, ask the skill author to update the registry metadata to declare TRANSITION_API_KEY as a required credential and to explain how the key is used, stored, and transmitted. 6) Revolve/rotate the key and revoke it immediately if you see unexpected activity.

Type: OpenClaw Skill Name: strava-skill Version: 1.0.0 The skill bundle is benign. It provides instructions and API endpoints for an AI agent to interact with the Transition API to access Strava data. All network calls are directed to the legitimate `api.transition.fun` domain, and the `TRANSITION_API_KEY` is used as expected for authentication. There is no evidence of data exfiltration, malicious execution (e.g., `curl|bash`), persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior in `SKILL.md` or `README.md`. The 'Tips for Agents' section in `SKILL.md` offers functional guidance for using the API, not malicious instructions.