WHOOP Health

Fetch, analyze, and visualize WHOOP wearable health data via the WHOOP Developer API v2. Use when the user wants to connect their WHOOP band, retrieve recove...

This skill appears to do what it says: perform OAuth against WHOOP and fetch health data. Before installing or running it: 1) Verify the WHOOP client_id and client_secret come from your WHOOP developer app (the scripts accept these via flags or WHOOP_CLIENT_ID/WHOOP_CLIENT_SECRET env vars). 2) Note the skill saves tokens to ~/.whoop_tokens.json (with 0600 perms) — protect this file and delete/revoke tokens when finished (whoop_auth.py --revoke). 3) The SKILL.md mentions API v2 but the code uses v1 endpoints; confirm the endpoints/versions match the WHOOP API you expect. 4) The auth flow spins up a localhost server on port 8080 for the OAuth redirect — ensure that port is acceptable to use. 5) Review the included scripts yourself (they are small and use only the Python standard library) before running, especially since this handles sensitive health data. If you need the registry metadata corrected (declare the token file path and optional env vars), ask the skill author to update those fields.

Type: OpenClaw Skill Name: whoop-health Version: 1.0.0 The skill bundle provides a legitimate integration with the WHOOP Developer API for health data retrieval and analysis. It implements a standard OAuth 2.0 flow in `scripts/whoop_auth.py`, securely stores tokens locally with restricted file permissions (0o600), and uses well-defined API endpoints in `scripts/whoop_fetch.py` without any evidence of data exfiltration, obfuscation, or malicious execution.