Wellness Hub

A personal Wellness hub for OpenClaw. Use when users want an all-in-one way to connect their health/wellness apps and devices (wearables, workouts, sleep, nu...

This skill appears to implement a local Wellness bridge and digest workflow, but take these precautions before installing/using it: - Missing declared tools: The docs assume you have 'clawhub' and optionally cloudflared/ngrok installed. The skill metadata declares no required binaries; ensure you install and vet those utilities separately (and that 'clawhub install <slug>' is safe and from a trusted source). - Tunnel exposure risk: The Tier‑2 bridge workflow requires running a public tunnel (Cloudflare Tunnel or ngrok) which exposes a local endpoint to the internet. Exposing a health-data ingest endpoint makes your phone uploads reachable from the public URL. Only run tunnels you trust, limit lifetime of the tunnel, and keep the token secret. - Local token & stored data: The bridge generates and stores a bearer token at ~/.config/openclaw/wellness/bridge/token.json and saves raw JSON payloads under inbox/YYYY-MM-DD/*.json. Tokens are written with restricted perms where possible, but payload files are stored unencrypted. Consider filesystem permissions, disk encryption, and periodically rotating/deleting data you don't need. - Verify source skills: The hub instructs installing source-specific skills (openclaw-whoop, openclaw-oura, etc.) via ClawHub. Review those skills before installing — they will handle OAuth/API tokens for third‑party services. - Operational caution: If you plan to use the loopback OAuth fast path or allow same‑machine redirects, understand those flows and avoid pasting bearer tokens back into chat. Follow the SKILL.md guardrails (do not use scraping/credential capture). If you are comfortable with these tradeoffs and will vet/limit tunnel usage and installed source skills, the code appears coherent with its stated purpose. If you prefer to avoid exposing any local endpoint publicly, do not use the Tier‑2 bridge and favor Tier‑1 direct OAuth integrations instead.

Type: OpenClaw Skill Name: wellness Version: 0.3.0 The wellness skill bundle is a well-structured health data aggregator that uses a local HTTP bridge (wellness_bridge.py) to ingest data from mobile devices via user-configured tunnels (e.g., Cloudflare or ngrok). The implementation follows security best practices, including the use of Bearer tokens for authentication, restrictive file permissions (chmod 600) for sensitive configuration, and a complete lack of third-party dependencies. No indicators of data exfiltration, malicious execution, or prompt injection were found; the code is transparent and aligned with its stated purpose.