← Back to Skills Marketplace
2366
Downloads
1
Stars
4
Active Installs
1
Versions
Install in OpenClaw
/install whoop
Description
WHOOP morning check-in (recovery/sleep/strain) with suggestions.
Usage Guidance
This skill appears to implement a legitimate WHOOP integration, but there are several red flags you should resolve before installing: (1) SKILL.md lists required env vars (WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, WHOOP_REFRESH_TOKEN) but the registry metadata does not — confirm which is authoritative. (2) The instructions call node scripts at hard-coded paths (/home/claw/.../bin/...), yet those bin scripts are not present in the package; ask the author for the missing files or a proper install spec. (3) The skill expects you to store refresh tokens in ~/.clawdbot/.env — decide whether you are comfortable keeping long-lived tokens on disk and verify file permissions. (4) Ensure a node runtime is available and that any executable scripts are reviewed before running. If you proceed, request the missing bin scripts or a full, documented install, review their code (especially any network, file-write, or exec calls), and consider restricting automatic invocation if you do not want the model to access WHOOP credentials without explicit user action.
Capability Analysis
Type: OpenClaw Skill
Name: whoop
Version: 0.1.0
The skill's purpose is to integrate with the WHOOP API for morning check-ins. It requires WHOOP OAuth credentials and a refresh token, which are handled through standard OAuth flows and stored locally in `~/.clawdbot/.env` and `~/.cache/whoop-morning/tokens.json`. The `SKILL.md` provides clear, non-malicious instructions for setup and execution, without any prompt injection attempts. The `lib/tokens.js` file manages the local storage of these necessary tokens. There is no evidence of data exfiltration, malicious execution, or unauthorized persistence.
Capability Assessment
Purpose & Capability
The described purpose (fetch WHOOP recovery/sleep/strain and produce suggestions) matches the need for WHOOP OAuth credentials (client id/secret/refresh token). However the registry metadata claims no required env vars while SKILL.md explicitly lists WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, and WHOOP_REFRESH_TOKEN — an inconsistency in the skill manifest.
Instruction Scope
Runtime instructions tell a user to write secrets into ~/.clawdbot/.env and run node scripts under /home/claw/clawd/skills/whoop/bin/ (including an auth flow that writes the refresh token). Those file/path operations involve storing and reading long-lived credentials on disk and reference hard-coded absolute paths. The SKILL.md also references bin scripts that are not present in the supplied file manifest, which is a functional and security concern.
Install Mechanism
There is no install spec (instruction-only), which normally lowers risk. But the package includes a code file (lib/tokens.js) yet the runtime instructions require node and call missing bin scripts. The skill fails to declare 'node' (or another runtime) as a required binary. This mismatch suggests the package is incomplete or improperly packaged.
Credentials
Requesting WHOOP_CLIENT_ID/SECRET and a refresh token is proportionate for an OAuth-based WHOOP integration. However the SKILL.md expects secrets to be saved to ~/.clawdbot/.env (a local file with long-lived credentials) and the registry metadata does not list those env vars — that inconsistency and disk storage of refresh tokens should be considered before granting access.
Persistence & Privilege
The skill does not set always: true or disableModelInvocation; by default the model can invoke it and it will only run when invoked. That is typical, but bear in mind if you grant this skill credentials they will be available whenever the model calls it, so consider whether you want autonomous access to the stored WHOOP tokens.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install whoop - After installation, invoke the skill by name or use
/whoop - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Rename + improve docs: publish as whoop; includes exact user/bot setup steps for OAuth and morning check-in.
Metadata
Frequently Asked Questions
What is WHOOP?
WHOOP morning check-in (recovery/sleep/strain) with suggestions. It is an AI Agent Skill for Claude Code / OpenClaw, with 2366 downloads so far.
How do I install WHOOP?
Run "/install whoop" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is WHOOP free?
Yes, WHOOP is completely free (open-source). You can download, install and use it at no cost.
Which platforms does WHOOP support?
WHOOP is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created WHOOP?
It is built and maintained by Borahm (@borahm); the current version is v0.1.0.
More Skills