Whoop Openclaw Skill

Fetch and analyze Whoop recovery, strain, sleep, and HRV data via the Whoop API. Use when the user asks about their Whoop metrics, recovery status, sleep qua...

This skill largely does what it claims (fetch Whoop data via OAuth). Before installing or running it, consider the following: - Metadata vs reality: The registry metadata lists no required credentials, but you must create a Whoop Developer app and provide client_id and client_secret in whoop-config.json (and the code can also read WHOOP_API_TOKEN). Treat those as sensitive secrets. - Token storage: The scripts save full access and refresh tokens to ~/.whoop_token and ~/.whoop_refresh_token (plain text). If you use it, ensure the files have restrictive permissions and run it on a trusted machine. - DO NOT follow the redirect.html instruction to send codes or tokens over chat (Telegram/WhatsApp) — that would leak your Whoop access to third parties. Prefer performing the exchange locally with whoop_oauth.py as documented in SKILL.md. - Audit and host redirect/privacy pages on a domain you control (or GitHub Pages) so you know where the auth flow points. Don't use strangers' hosted pages. - If you proceed: review the included scripts yourself, run them locally, avoid pasting tokens into external services, and if you suspect any leak revoke the app/refresh tokens in your Whoop developer settings. Summary action items: verify source/trust of this package (source unknown), update metadata/ask the publisher to declare required credentials, inspect file permissions for token files, and never transmit auth codes/tokens via untrusted messaging.

Type: OpenClaw Skill Name: whoop-openclaw-skill Version: 1.0.0 The skill bundle is a well-structured and functional integration for the Whoop API. All Python scripts interact exclusively with legitimate Whoop API endpoints for data fetching and OAuth. Token handling is secure, using standard locations (`~/.whoop_token`, `~/.whoop_refresh_token`) and practices (e.g., CSRF protection). There are no shell injection vulnerabilities, no attempts to access sensitive files outside of designated token files, and no data exfiltration to unauthorized external endpoints. The `SKILL.md` and `README.md` provide instructions for the AI agent to execute the skill's own benign scripts, with no evidence of prompt injection to subvert the agent's purpose. The OAuth HTML pages are client-side and perform standard redirect functions without malicious code.