TrainingPeaks

Pull real-time training plans, workouts, fitness metrics (CTL/ATL/TSB), and personal records from TrainingPeaks. Uses cookie-based authentication (no API key needed). Use in conjunction with other endurance, cycling, running or swimming triathlon coach skills for best results.

This skill appears to do what it says, but it requires you to copy/paste your TrainingPeaks session cookie (Production_tpAuth) — a long-lived secret that grants access to your account. Only paste that cookie into this tool if you trust the skill and the environment where the agent runs. Recommendations before installing: 1) Review the included scripts/tp.py (already done) — it only talks to https://tpapi.trainingpeaks.com and stores data under ~/.trainingpeaks. 2) If you proceed, store the cookie only on a trusted machine, or use the TP_AUTH_COOKIE env var for short-lived CI runs. 3) To revoke local access, delete ~/.trainingpeaks (cookie, token.json, config.json). 4) Prefer official API keys if TrainingPeaks offers them — copying a session cookie is more sensitive. 5) Note the package source is anonymous (no homepage/unknown owner); if you have concerns about provenance, run the script in an isolated environment (container/VM) or avoid using it.

Type: OpenClaw Skill Name: trainingpeaks Version: 1.0.1 The OpenClaw AgentSkills bundle for TrainingPeaks is benign. The `SKILL.md` provides clear, legitimate instructions for cookie-based authentication and usage, without any prompt injection attempts or deceptive phrasing. The `scripts/tp.py` Python code uses only standard library modules, communicates exclusively with the official `tpapi.trainingpeaks.com` endpoint, and stores credentials (`cookie`, `token.json`, `config.json`) securely in `~/.trainingpeaks/` with `0o600` permissions. There is no evidence of data exfiltration to unauthorized destinations, malicious execution, persistence mechanisms, or other high-risk behaviors.