WHOOP CLI for Agents

Use whoop-cli to fetch WHOOP data, generate day briefs/health flags, and export trend data for automation workflows.

Do not install or enable this skill until you verify its origin. Steps to consider: 1) Confirm the npm package and GitHub repo referenced in SKILL.md (@andreasnlarsen/whoop-cli) are legitimate and match the maintainer listed in the registry. 2) Be wary that the registry metadata omits the env vars and install instructions that SKILL.md requires — ask the publisher to fix the manifest or provide a signed/verified source. 3) If you proceed, install the whoop CLI yourself (npm install -g @andreasnlarsen/[email protected]) and perform OAuth login locally; never paste client secrets into chat. 4) Inspect ~/.whoop-cli profiles after login to confirm tokens are local and as expected. 5) Prefer read-only commands (summary, day-brief, health, trend, sync pull) and avoid granting the agent permissions to perform auth/login on your behalf. If the skill's origin cannot be confirmed or the manifest corrected, avoid enabling it.

Type: OpenClaw Skill Name: whoop-cli Version: 0.3.1 The skill bundle appears benign. It provides instructions for an AI agent to interact with the `whoop-cli` for health data access. The `SKILL.md` explicitly includes strong security guardrails, instructing the agent to never ask for or print client secrets/tokens, to prefer local login, and to use read-only commands. While it includes commands to export data to local files (`whoop sync pull --out ./whoop.jsonl`) and manage local experiment state (`~/.whoop-cli/experiments.json`), these are legitimate functions of the stated purpose and lack any indication of malicious intent such as exfiltration, unauthorized execution, or persistence mechanisms. All commands are standard uses of the `whoop` CLI and `npm` for installation.