Oura Ring

Fetch Oura Ring readiness/sleep + 7-day readiness trends via Oura Cloud API V2, and generate a Morning Readiness Brief.

What to check before installing or running this skill: - Expect to provide an OURA API token (OURA_TOKEN or OURA_PERSONAL_ACCESS_TOKEN). The package metadata did not declare this — that mismatch is likely an oversight. Do not proceed until you understand where your token will be stored (skills/oura-ring/.env is the default) and ensure you don't commit that file to source control. - Inspect and (ideally) remove or sanitize the probe_v2.py and probe_v2_sessions.py files. They reference a hard-coded developer path (/Users/sameerbajaj/...) and load a token from that location; that looks like leftover developer/debug code. If you do not need them, delete them to avoid accidental execution or accidental use of a local .env. - Confirm dependencies before running: requirements.txt lists requests and python-dotenv, but the probe scripts use httpx. If you run probes, install httpx separately or avoid running them. - Run the CLI in an isolated environment (virtualenv) as suggested and review the .env contents. Consider creating a least-privilege Oura API app/token rather than using broad personal tokens. - If you will allow an autonomous agent to call this skill, be aware it can access the Oura token you supply; ensure the agent's authorization scope and the token’s scope are limited to what you intend. If the registry entry is meant to be public, ask the skill owner to update the manifest to declare the required environment variable(s) and to remove or document the probe scripts and any hard-coded paths. If you are unsure about the probe files or hidden behavior, prefer not to install or run the skill until the author clarifies.

Type: OpenClaw Skill Name: oura-ring-skill Version: 0.1.0 The skill is generally benign, fetching Oura Ring data via its API. However, the `probe_v2.py` and `probe_v2_sessions.py` files contain hardcoded paths to the `.env` file (`/Users/sameerbajaj/clawd/skills/oura-ring/.env`). While these are likely debug scripts and the path points to the skill's own configuration, hardcoding paths to files that contain secrets is a risky practice and could lead to issues in different environments or accidental information exposure, classifying it as suspicious rather than benign.