WHOOP Health Data Sync

Sync WHOOP health data (recovery, sleep, strain, workouts) to markdown files for AI-powered health insights. Use when user asks about WHOOP data, health metr...

This skill appears to do what it says (sync WHOOP -> markdown), but there are three things you should check before installing or running it: 1) Remove or inspect the included data/tokens.json: the package contains an access_token and refresh_token. If those tokens are valid, they grant access to WHOOP data. Do NOT install/run with those tokens present; delete or replace tokens.json and run auth.py yourself to create fresh tokens. 2) Expect undeclared dependencies: the scripts invoke the 1Password CLI ('op') and curl via subprocess. Ensure you understand whether you want the skill to access your 1Password vault or a local .op-token file (it looks for ~/.openclaw/.op-token). If you don't use 1Password, set WHOOP_CLIENT_ID/WHOOP_CLIENT_SECRET as environment variables and make sure curl/op aren't available to the runtime if you want to prevent that code path. 3) Sensitive data persistence & automation: the skill stores refresh tokens on disk (allows long-lived access) and writes health reports to ~/.openclaw/workspace/health — consider whether you want those files present on the machine and ensure correct file permissions and that automated cron tasks are scheduled only on machines you trust. Additional recommendations: inspect auth.py and sync.py locally (they are human-readable), regenerate WHOOP client secrets if you accidentally used any included tokens, and only run this skill on a trusted device. If you need help verifying whether the provided tokens are live, do not paste them here — instead, remove the file and run an auth flow yourself.

Type: OpenClaw Skill Name: whoop-health-sync Version: 1.0.0 The bundle is a legitimate tool for syncing WHOOP health metrics (recovery, sleep, strain) to local Markdown files. It implements a standard OAuth 2.0 flow using a local callback server in `scripts/auth.py` and handles data retrieval in `scripts/sync.py`. While it uses `curl` to bypass Cloudflare API blocks and can optionally interface with the 1Password CLI (`op`) for credential management, these behaviors are explicitly documented in the `README.md` and `SKILL.md` and are aligned with the stated purpose. No evidence of data exfiltration or malicious intent was found.