Ouraskill

Syncs daily health and fitness data from Oura Ring into markdown files. Provides sleep, readiness, activity, heart rate, stress, SpO2, and workout data.

This skill appears to do what it says: use your Oura personal access token to fetch data and write local markdown files. Before installing: (1) confirm you trust the skill source or review the full script (it's included) — the oura_ring dependency will be installed when running via uv, so verify that package on PyPI; (2) run it inside a dedicated directory or virtual environment and check the health/ files it writes; (3) when scheduling via cron, avoid embedding the token directly in world-readable crontabs — use a secure environment or a credential manager; (4) if you ever suspect misuse, revoke the Oura personal access token from your Oura account. Overall risk is low and required access is proportionate, but standard precautions (review dependency provenance and limit token exposure) are recommended.

Type: OpenClaw Skill Name: oura-ring Version: 1.0.3 The skill is classified as suspicious due to a path traversal vulnerability in `scripts/sync_oura.py`. The `--output-dir` argument, if manipulated by a malicious prompt to the AI agent, could allow writing markdown files to arbitrary locations on the filesystem (e.g., `/etc/passwd` or `/tmp/sensitive_data`). While the content written is benign markdown (Oura health data) and not arbitrary code, this vulnerability could lead to data corruption or denial of service if critical system files are overwritten. There is no evidence of intentional malicious behavior or data exfiltration beyond the stated purpose.