Strava Training Coach

AI running coach that prevents injuries by monitoring your Strava training load daily. Detects dangerous mileage spikes, intensity imbalances, and recovery g...

This skill appears to do what it claims, but before installing: 1) Review the included scripts yourself (they are bundled) to confirm nothing is altered; 2) Keep STRAVA_CLIENT_SECRET and webhook URLs private and store them in your environment (not in git); 3) Be aware the OAuth flow opens a local server on localhost:8080 — ensure that's acceptable in your environment; 4) Rotate webhook URLs if they are ever exposed, and restrict the webhook channels to minimize blast radius; 5) Run the scripts in a contained environment (virtualenv/container) if you want to limit filesystem/network exposure; 6) If enabling Oura or any extra integrations, verify what additional credentials or CLIs they require. Overall this skill is internally consistent and proportionate, but only install if you trust the source and have reviewed the bundled code.

Type: OpenClaw Skill Name: strava-training-coach Version: 1.0.3 The skill bundle demonstrates strong security practices, aligning with its stated purpose of being an AI running coach. It uses environment variables for all sensitive data, stores tokens securely with 0600 permissions in XDG-compliant directories, implements robust input validation (including regex for webhook URLs), redacts sensitive information from logs, and uses HTTPS with timeouts for all network communication. The `SKILL.md` provides clear instructions without any evidence of prompt injection attempts to manipulate the AI agent for malicious purposes. All file and network access is strictly confined to the legitimate functionality of interacting with Strava, Oura, and notification services (Discord/Slack).