Withings Family

Fetches health data from the Withings API for multiple family members including weight, body composition (fat, muscle, bone, water), activity, and sleep. Use...

This skill appears to do exactly what it says: it needs your Withings developer Client ID/Secret and will store per-user OAuth tokens in ~/.openclaw/withings-family (legacy ~/.moltbot/withings-family). Before installing, consider: (1) only provide WITHINGS_CLIENT_ID/WITHINGS_CLIENT_SECRET if you trust the skill/source; (2) the scripts start a local callback server (localhost:18081) during OAuth — ensure that port is available and run the flow only on a trusted machine; (3) token files are written to your home directory and the code attempts to chmod them to 0600 — verify those files and revoke tokens in your Withings account if you stop using the skill; (4) the SKILL.md contains a minor doc mismatch (the oauth helper docstring mentions port 8080 but the script and README use 18081), which is non-malicious but worth noting; (5) because code is included in cleartext, you can and should review it yourself if you have concerns. Overall the requirements and behavior are proportionate to the skill's purpose.

Type: OpenClaw Skill Name: withings-family Version: 1.1.2 The OpenClaw Withings Family skill is benign. It securely handles OAuth authentication with Withings API, including robust user ID sanitization to prevent path traversal for token files, secure file permissions (0o600) for sensitive tokens, and CSRF protection using a 'state' parameter during the OAuth flow. All network communication is directed to legitimate Withings API endpoints, and there is no evidence of data exfiltration to unauthorized destinations, malicious command execution, persistence mechanisms, or prompt injection attempts in the SKILL.md documentation. The code's functionality is entirely aligned with its stated purpose of fetching health data.