WHOOP

WHOOP morning check-in (recovery/sleep/strain) with suggestions.

This skill appears to implement a legitimate WHOOP integration, but there are several red flags you should resolve before installing: (1) SKILL.md lists required env vars (WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, WHOOP_REFRESH_TOKEN) but the registry metadata does not — confirm which is authoritative. (2) The instructions call node scripts at hard-coded paths (/home/claw/.../bin/...), yet those bin scripts are not present in the package; ask the author for the missing files or a proper install spec. (3) The skill expects you to store refresh tokens in ~/.clawdbot/.env — decide whether you are comfortable keeping long-lived tokens on disk and verify file permissions. (4) Ensure a node runtime is available and that any executable scripts are reviewed before running. If you proceed, request the missing bin scripts or a full, documented install, review their code (especially any network, file-write, or exec calls), and consider restricting automatic invocation if you do not want the model to access WHOOP credentials without explicit user action.

Type: OpenClaw Skill Name: whoop Version: 0.1.0 The skill's purpose is to integrate with the WHOOP API for morning check-ins. It requires WHOOP OAuth credentials and a refresh token, which are handled through standard OAuth flows and stored locally in `~/.clawdbot/.env` and `~/.cache/whoop-morning/tokens.json`. The `SKILL.md` provides clear, non-malicious instructions for setup and execution, without any prompt injection attempts. The `lib/tokens.js` file manages the local storage of these necessary tokens. There is no evidence of data exfiltration, malicious execution, or unauthorized persistence.