WHOOP Central

WHOOP Central - OAuth + scripts to fetch WHOOP data (sleep, recovery, strain, workouts). Use when user asks about their sleep, recovery score, HRV, strain, or workout data.

This skill appears to do what it says: it implements a local OAuth bootstrap and fetches WHOOP data, storing client credentials and tokens on your machine and writing imported logs to your home directory. Before installing/running: 1) Review the code (or run in an isolated environment) if you don't fully trust the source. 2) Register your own WHOOP developer app and use its client_id/client_secret rather than sharing credentials. 3) Be aware the scripts save credentials/tokens to disk (default: ~/.clawdbot/whoop/ token.json and credentials.json); protect that directory and back up/rotate secrets as appropriate. 4) The import script writes logs to ~/clawd/health/logs/whoop/ — confirm that location is acceptable. 5) If you plan to use the local HTTPS callback, the script will generate a self-signed cert using openssl and may require you to proceed past browser TLS warnings. 6) Minor inconsistencies: SKILL.md recommends an HTTPS localhost redirect URI but auth.js defaults to http://localhost:3000/callback unless you set WHOOP_REDIRECT_URI; ensure your registered redirect exactly matches what you use. Overall: safe/consistent for its stated purpose, but follow standard precautions for any code that stores OAuth client secrets and tokens locally.

Type: OpenClaw Skill Name: whoop-central Version: 1.0.2 The OpenClaw skill 'whoop-central' is designed to integrate with the WHOOP API to fetch personal health data and store it locally. All file system operations (e.g., storing credentials/tokens in `~/.clawdbot/whoop/` and health logs in `~/clawd/health/logs/whoop/`), network calls (exclusively to `https://api.prod.whoop.com`), and child process executions (`openssl` for local HTTPS certs, `open`/`start`/`xdg-open` for browser interaction) are directly aligned with this stated purpose. There is no evidence of data exfiltration to unauthorized endpoints, malicious persistence, or prompt injection attempts in `SKILL.md`.