WHOOP (Official API)

Connect to the WHOOP Developer Platform via official OAuth (authorization code flow), store and refresh tokens, and fetch WHOOP v2 data (recovery, sleep, cyc...

This package looks like a reasonable WHOOP OAuth client: it talks only to WHOOP endpoints, stores tokens locally (default ~/.config/openclaw/whoop/token.json), and renders user-facing summaries. Before installing: 1) Confirm the source/owner is trusted — the registry metadata and the SKILL.md disagree about required environment variables; the scripts DO require WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, and WHOOP_REDIRECT_URI. 2) Provide only a WHOOP app/client with minimal scopes (e.g., read:recovery, read:sleep, read:cycles). 3) Consider setting WHOOP_TOKEN_PATH to a secure location and verify the token file permissions after creation; revoke the app/client from your WHOOP developer dashboard if you later remove the skill. 4) Understand loopback mode opens a local HTTP listener to capture the OAuth code — only use that if you trust the environment and the redirect URI. 5) Ask the publisher to correct the registry metadata to declare the required env vars and primary credential so automated permission reviews work correctly.

Type: OpenClaw Skill Name: openclaw-whoop Version: 0.1.2 The skill bundle is a standard and well-implemented integration for the WHOOP API. It follows security best practices by using environment variables for secrets, implementing the official OAuth 2.0 Authorization Code flow, and securing local token storage with restrictive file permissions (0600) in `whoop_token.py`. The scripts (`whoop_fetch.py`, `whoop_oauth_login.py`) use Python's built-in `urllib` to avoid third-party dependency risks, and the instructions in `SKILL.md` are strictly aligned with the stated purpose of fetching and rendering fitness metrics without any evidence of malicious intent or data exfiltration.