VITA — Longevity Intelligence

Access the user's personal health data from VITA, their longevity platform. Use this when the user asks about their health, how they're feeling today, sleep,...

This skill appears to do what it says (call VITA and return health insights), but the published metadata does not match the runtime instructions. Before installing: 1) Confirm you trust the skill publisher and VITA (no homepage or known source is provided). 2) Be comfortable storing an API key in ~/.openclaw/openclaw.json (it will be in plain JSON unless you take extra precautions). 3) Prefer creating a least-privilege VITA API key you can revoke, and rotate/revoke it if you stop using the skill. 4) Verify the API URL is the official VITA endpoint and watch for any unexpected network calls when using the skill. 5) If you need stronger protection, ask the skill author to declare required env/config in the registry metadata or to support a more secure secret storage option. If you cannot verify the author/source or are uncomfortable storing the key in your agent config, do not enable the skill.

Type: OpenClaw Skill Name: vita-app Version: 1.0.0 The skill accesses sensitive personal health data via an API, which is a high-risk operation, even if it's the stated purpose. It uses `curl` with dynamic parameters (`action`) to interact with the API, as shown in `SKILL.md`. While intended for legitimate API calls to `app.vitadao.com`, the dynamic nature of the `action` parameter in a shell command introduces a potential shell injection vulnerability if the AI agent's input sanitization is insufficient. There is no evidence of intentional malicious behavior, but the combination of sensitive data access and a potential command injection vector classifies it as suspicious.