Whoop

Access Whoop wearable health data (sleep, recovery, strain, HRV, workouts) and generate interactive charts. Use when the user asks about sleep quality, recovery scores, strain levels, HRV trends, workout data, or wants health visualizations/graphs from their Whoop band.

This skill appears to do exactly what it says: authenticate with Whoop, fetch your wearable data, and make charts. Before installing/running, consider: 1) The OAuth flow saves your client_id, client_secret, access_token, and refresh_token to ~/.clawdbot/whoop-tokens.json — review and protect that file (it is written with 0o600 where possible). 2) The `token` command prints the access token to stdout; avoid running commands in contexts that log terminal output or share stdout. 3) Generated HTML pages load charting code from a CDN (jsdelivr); opening them requires a network request and is a minor supply-chain/privacy risk — if you prefer, host a local copy of the charting library. 4) The local OAuth callback uses port 9876; ensure that port is available and acceptable in your environment. 5) If you want least-privilege, create the Whoop app with only the scopes you need instead of selecting all. Review the repository files locally before running and delete the token file (whoop_auth.py logout) when you no longer want persistent access.

Type: OpenClaw Skill Name: whoop-health-analysis Version: 1.1.0 This skill is classified as benign. It provides functionality to access Whoop health data, generate interactive charts, and perform health analysis. The authentication process uses standard OAuth 2.0, storing tokens locally in `~/.clawdbot/whoop-tokens.json` with appropriate permissions. All network requests are directed to legitimate Whoop API endpoints (`https://api.prod.whoop.com`). While `SKILL.md` contains instructions for the AI agent to read `references/health_analysis.md` for interpretation (a form of prompt injection), this is for the stated purpose of guiding health analysis and includes disclaimers that it is not medical advice. There is no evidence of unauthorized data exfiltration, malicious execution, persistence, or obfuscation.