WHOOP (Official API)

Connect to the WHOOP Developer Platform via official OAuth (authorization code flow), store and refresh tokens, and fetch WHOOP v2 data (recovery, sleep, cyc...

This skill appears to be what it says: an official WHOOP OAuth client and data fetcher. Before installing, make sure you: (1) supply WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, and WHOOP_REDIRECT_URI via environment variables (the registry metadata currently doesn't list these, so the omission is just a bookkeeping mismatch), (2) are comfortable storing OAuth tokens and refresh tokens on the host at the default token path (~/.config/openclaw/whoop/token.json) or set WHOOP_TOKEN_PATH to a secure location, (3) protect the client secret and token file (file permissions and host security), and (4) review the bundled scripts if you want to confirm there are no changes from an official source. If you plan to schedule cron pushes, ensure the cron job's destination channel parameter is correct and that you trust the machine running scheduled jobs. If any of these points are unacceptable, do not install or run the skill until addressed.

Type: OpenClaw Skill Name: openclaw-slug Version: 0.1.0 The WHOOP skill bundle is a standard and well-implemented API integration. It facilitates OAuth 2.0 authorization, data fetching, and normalization for WHOOP health metrics. The scripts (whoop_fetch.py, whoop_token.py, etc.) use Python's standard library to interact exclusively with official WHOOP endpoints (api.prod.whoop.com), and token storage is handled securely using restricted file permissions (0o600). No evidence of data exfiltration, malicious execution, or prompt injection was found.