Whoo CLI

Use the whoo CLI to retrieve and interpret WHOOP health data: recovery score, HRV, sleep quality, strain, SpO2, and body measurements. Invoke when the user a...

This skill appears to do what it says: it wraps the whoo CLI to fetch WHOOP data via OAuth. Before installing or running it: (1) verify the npm/bun package author and review the GitHub source referenced (https://github.com/LuisGot/whoo) — global npm installs execute third‑party code; (2) prefer installing in a contained environment (container or dedicated user account) if you are worried about supply‑chain risk; (3) be aware you must create a WHOOP developer app and supply client_id/client_secret; tokens will be stored on disk in your OS config directory — ensure that location's permissions and backups are acceptable; (4) follow the skill's own advice: treat returned health data as sensitive and do not forward raw JSON to external services. If you want a higher assurance level, inspect the package code you will install (or run it from source) before granting it access to your account.

Type: OpenClaw Skill Name: whoo-cli Version: 0.1.1 The skill is classified as suspicious primarily due to the supply chain risk introduced by instructing the agent to install an external, globally available package (`@luisgot/whoo`) via `bun add -g` or `npm install -g` in `SKILL.md`. While this is a common pattern for CLI-based skills and the skill itself demonstrates good security practices (e.g., explicit prompt injection defense for JSON output and a data privacy notice), the act of installing an arbitrary external package from a public registry presents a significant vulnerability if the upstream package were to be compromised or malicious. There is no direct evidence of malicious intent within the provided files, but the reliance on an external, globally installed dependency elevates the risk beyond benign.