How do I share Apple Health with OpenClaw-style agents?

What do you get?

An OpenClaw shell skill can run your local Syncky agent to read selected Apple Health data and request permitted write-back with source and undo. Free during launch; plans are coming later. See launch access and pricing.

Client health-data envelopes are sealed end to end. Relay sees delivery metadata and plaintext hub notices, but no health values. The local agent keeps plaintext JSON in its inbox; a chosen model sees what the agent supplies. iOS decides background timing and Health reads need an unlocked iPhone. Data can be hours old and writes wait for sync; undelivered envelopes leave Relay on acknowledgment or expiry, at most 7 days.

What do you need before setup?

Use a machine you control with Node.js 22.15 or newer, a POSIX shell and outbound HTTPS to the matching relay. The repository skill needs npm; a carried skill includes its bundle and launcher. Choose your data and model deliberately. The agent setup guide explains app-build/relay selection. Keep the same SYNCKY_AGENT_HOME for setup, the skill and the receiver; the default is ~/.syncky-agent.

How do you set up OpenClaw?

Choose the skill package. The public repository skill uses npm. Place it in the workspace's skills/syncky folder or ~/.openclaw/skills/syncky for user-wide use.
For the carried alternative, download syncky-agent-clawhub.tar.gz and SHA256SUMS from the matching release, verify the archive's SHA-256 against that list, then run from the download directory:
```
tar -xzf syncky-agent-clawhub.tar.gz &&
mkdir -p "$HOME/.openclaw/skills/syncky" &&
cp -R ./clawhub/syncky/. "$HOME/.openclaw/skills/syncky/"
```
Copy the complete skill, including SKILL.md, syncky-agent, bundle and notices. The installed launcher is ~/.openclaw/skills/syncky/syncky-agent; it verifies its adjacent bundle's pinned SHA-256 and needs no npm at runtime. A checksum detects damage, not a compromised release. Read the installed SKILL.md before use; local packaging tests do not establish host discovery or client UI behavior.
In the skill-capable host, request: Use Syncky and start onboarding with a QR code. A supported runtime, reachable relay and any required invite must already be available. The skill runs selftest, initializes only a fresh home and returns a private QR/code; reuse an existing home. Keep QR credentials, invites and home files out of chat and logs.
Scan in Syncky Health and pick the displayed code on the iPhone. Select read types, allowed write types and Health permissions. Scanning alone does not confirm trust: let an existing receiver collect the proof, or wait for it once after the code pick. With the repository/npm skill, that command is:
```
npx -y @syncky/agent wait --timeout 600
```
The carried skill uses its installed launcher for the same operation.
Choose continuous receiving or on-demand collection explicitly. For continuous receiving with the npm skill, deliberately run:
```
npx -y @syncky/agent receive
```
For on-demand use, run npx -y @syncky/agent receive --once instead. Use the installed launcher for the carried skill. Keep one receiver per home and reuse it. Services and schedules require your explicit request; onboarding alone does not install them. Without a continuous receiver, uploads wait for the next collection and the app can report a missed check-in.
Request the status/scope check below before reading selected data.

What can OpenClaw read and write?

The shell skill uses the agent's commands: status for pairing and scope, inbox for what the iPhone sent, send for messages to the iPhone and ack to mark inbox entries as handled. It does not need MCP. The agent keeps what the iPhone sent as daily JSON files in its home (inbox/), prunes them after 30 days, and keeps the last 100 send receipts. There is no database and no built-in summaries: your AI agent reads the files it needs. For a host with local MCP support, the conditional stdio alternative is npx -y @syncky/agent mcp, or checksum-verified syncky-health.mcpb imported into a compatible client; Node.js is still required. Neither alternative pairs nor starts a receiver.

Every write to Apple Health, every sync report request and every request for more Health types is a message the agent sends to the iPhone. Writes apply only to the types the owner allowed for writing in the app; a sync report or more Health types need the owner's tap on the phone. The signed skill carries the exact formats and limits.

Write only owner-requested entries or entries covered by explicit standing approval. A write is applied only when its type is in the app's write allowance, within the agent's write scope, and authorized by HealthKit (iOS write permission). Written entries mark the requesting agent as their source. A queued or sent write is not an applied write: read the phone's result after sync with npx -y @syncky/agent inbox --type sync --limit 100 or the carried launcher's equivalent. To undo, use the iPhone's remove-written-entries control or have the agent send a delete command for its own entry. Follow the operator security rules.

How do you test the connection?

After QR onboarding, ask: Use Syncky to check the paired iPhone and its read/write scope. Do not read sample values or write anything. The npm skill uses npx -y @syncky/agent status --json; the carried skill uses its installed launcher. Expect a confirmed iPhone and its last reported sharing/write scope. CLI status reads local state without contacting Relay; it does not establish fresh or complete sample delivery. Missing data does not mean zero.

How do you troubleshoot this setup?

Missing runtime or damaged package: provide Node.js 22.15 or newer on PATH, check the archive checksum and recopy the complete carried folder. Do not edit the launcher's pinned digest.
Skill unavailable: check the workspace/user skill location and read the installed SKILL.md; other skill hosts use their own directories. The agent options include Codex, Hermes and shell workflows.
Wrong home or relay: use the same paired home and saved relay for skill and receiver; do not initialize over existing state.
Unconfirmed pairing: pick the phone's code and let the existing receiver collect its proof, or wait for it once with no receiver running.
Stale data: check receiving, unlock the phone, review selected categories/Health access and sync in the app. iOS decides background timing.

What are the frequently asked questions?

Does a carried skill need npm or network access?

Its launcher needs Node.js and a POSIX shell, but no npm at runtime. Relay operations still need outbound HTTPS; offline access only sees what is already in the inbox.

Does installing the skill enable writing automatically?

Writing still requires the types you allowed for writing in the iPhone app, agent scope and iOS Health write permission. Ask for specific entries deliberately and read the results after sync. Installing a skill is not approval for automatic writes or schedules.

Who sees the data and what if the phone is asleep?

Your local agent receives plaintext and your chosen model sees what the agent supplies. Delivery depends on iOS scheduling and an unlocked iPhone. Protect local storage and review Privacy and the public security policy.

Agent setup · MCP comparison · All guides · FAQ.

Can the skill ask for more Health access?

Only with your explicit approval: the agent sends an access request, naming the read and write types it needs and an optional plain-text reason. A queued request grants nothing. The owner reviews each type on the phone and taps Allow or Decline; the reply arrives in the inbox and the next ordinary sync confirms the new scope. Asking for access is separate from permission to write Health values.