📦 Run Coach — 科学跑步教练
v1.0.7基于运动科学的AI跑步教练，生成高清可视化训练计划并同步Garmin，覆盖5K健身到全马各阶段跑者。
0· 211·0 当前·0 累计
by 下载技能包
最后更新
2026/4/19
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
What to consider before installing:
- The skill requires a Telegram bot token (TELEGRAM_BOT_TOKEN). Anyone with that token can control your bot, so create a dedicated bot and keep the token private. Use a dedicated chat id or account for the bot to minimize exposure.
- Garmin integration is optional but requires GARMIN_EMAIL and GARMIN_PASSWORD; if you enable it the unofficial garminconnect library will be used and a session token file (garmin/.garth) will be stored on disk. Only provide Garmin ...详细分析 ▾
✓ 用途与能力
Name/description (Telegram coach + optional Garmin sync + image pipeline) align with the included files and envs: Telegram bot token + chat id are required and node is used for the image/sending pipeline. Garmin sync code exists and is described as optional in SKILL.md, which matches that GARMIN_EMAIL/ GARMIN_PASSWORD are not required by the skill metadata but are documented for optional use.
ℹ 指令范围
SKILL.md directs the agent to execute local scripts (text-to-image.sh, send-plan.sh and the Node/Python helpers) and to read/modify MEMORY.md for the user profile. That scope matches the stated features. Note: the garmin sync script will read GARMIN_EMAIL/GARMIN_PASSWORD from env and will perform network calls to Garmin and write token/cache and JSON activity files to the garmin/ directory; these actions are limited to the stated optional Garmin functionality but will persist credentials/tokens on disk if used.
✓ 安装机制
There is no automatic install spec (instruction-only), which reduces supply-chain risk. SKILL.md instructs you to run apt-get, pip install, and npx playwright install if you want images — these are user-run instructions rather than automatic downloads from unknown hosts. Playwright and garminconnect are public packages; the files included are local scripts that call those tools.
ℹ 凭证需求
Required env vars declared in metadata are just TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID — appropriate for Telegram-based operation. Garmin credentials are documented as optional in SKILL.md (GARMIN_EMAIL, GARMIN_PASSWORD) and are only needed for the optional garmin-sync script; however, those optional envs are not listed in the metadata requires.env. GARMIN_PASSWORD is sensitive and, if provided, will be used by an unofficial garminconnect library and a session token will be cached to disk in garmin/.garth.
✓ 持久化与权限
always is false and the skill does not request system-wide persistence. The garmin sync implementation caches session tokens and writes JSON activity files under the skill's garmin/ directory — normal for a sync tool but worth noting for privacy. The skill does not modify other skills or global agent settings.
⚠ training/send-album.mjs:9
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.72026/3/19
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install run-coach
镜像加速npx clawhub@latest install run-coach --registry https://cn.longxiaskill.com镜像同步中