coach

The skill’s coaching and Strava capabilities are coherent with its purpose. The main concern is forwarding a Strava Client Secret to an unpinned external CLI whose handling is not verifiable from the supplied skill; the project has a documented repository and release path, and no evidence here confirms credential theft or malicious behavior. Treat as suspicious pending verification of the exact npm package and its credential/network handling.