Strava CLI Skill

Use the stravacli terminal tool to access Strava data (athlete profile, activities, streams, routes, segments, clubs, gear, uploads) and perform limited writ...

This skill is a thin wrapper that instructs the agent to call the external stravacli CLI. Before installing or following its instructions: (1) review the GitHub repo and release artifacts you will install (check source and release integrity) because installing binaries or running `go install` executes third‑party code; (2) be aware stravacli will perform OAuth and store tokens locally—know where tokens are saved and protect/revoke them if needed; (3) the skill will only perform writes if you confirm, but double-check any upload/update commands before approving; (4) if you need headless auth, avoid exposing callback URLs you don't control, as that may leak tokens. If any of these points are unacceptable, do not install or run the external CLI.

Type: OpenClaw Skill Name: stravacli Version: 2.2.98 The skill bundle is benign. It provides instructions for an AI agent to install and use the `stravacli` terminal tool for Strava operations. The `SKILL.md` file contains clear, transparent instructions for setup, authentication, and command usage, including legitimate file export and upload actions. There is no evidence of prompt injection attempts, data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or obfuscation within the provided files. The reliance on an external binary from GitHub is a standard integration pattern and does not indicate malice in the skill bundle itself.