Vitavault

VitaVault iOS app integration - sync Apple Health data directly to your AI agent. Auto-setup webhook, token generation, and HTTPS exposure. Works with any iP...

Before installing or running this skill, consider the following: 1) Health data is highly sensitive — exposing an HTTP(S) webhook to the public (even via tunnels) risks leakage if the sync token is misconfigured, leaked, or omitted. Ensure the VITAVAULT_SYNC_TOKEN is set, long, and stored securely. 2) The SKILL.md repeatedly promises "no middleman," but scripts/query.py requires a VITAVAULT_API_URL (a cloud API endpoint) — ask the developer what that cloud client is for and whether it will send or pull data from an external server. 3) The instructions create a systemd service and recommend sudo operations; only proceed if you trust the code and understand how to adjust file paths, service user, and firewall rules. 4) Prefer Tailscale Funnel or a private domain behind your own reverse proxy over public temporary tunnels for long-term use; temporary tunnels (ngrok, trycloudflare) are fine for short tests but not recommended for production health sync. 5) Review the shipped Python scripts yourself (or run them in an isolated VM/container) — the webhook code shown saves incoming payloads locally and does not call external endpoints, but the query client will contact whatever URL you set in VITAVAULT_API_URL. 6) If you accept the setup, perform an initial test with innocuous data, verify Authorization header enforcement, and restrict exposure (use firewall rules, Tailscale, or private domain). If you need more certainty, ask the skill author to explicitly document the cloud API behavior and to include a manifest of which components are optional (local webhook vs cloud client).

Type: OpenClaw Skill Name: vitavault Version: 1.3.0 The skill is classified as suspicious due to a significant contradiction between its stated purpose and the functionality of `scripts/query.py`. The `SKILL.md` explicitly claims "No shared servers, no middleman - data flows phone to your agent only" and that data is saved "nowhere else" than the agent's host. However, `scripts/query.py` is designed to query a *remote* API (requiring `VITAVAULT_API_URL` environment variable) and is listed in `SKILL.md` under 'Querying Health Data' as if it operates on local data. This deceptive representation of external network activity, despite claims of local-only data handling, raises concerns about transparency and potential for undisclosed data interactions.