WHOOP Morning

Check WHOOP recovery/sleep/strain each morning and send suggestions.

This skill mostly does what it says (WHOOP OAuth and daily suggestions), but there are mismatches you should resolve before installing: 1) SKILL.md expects two executable scripts (whoop-auth and whoop-morning) at /home/claw/… but those binaries are not present in the package — confirm their origin and inspect them before running. 2) The registry metadata does not list the required env vars even though SKILL.md does — verify which variables the runtime actually needs. 3) The skill will store your WHOOP_CLIENT_ID/SECRET and tokens in ~/.clawdbot/.env and ~/.cache/whoop-morning/tokens.json; treat these as sensitive, check file permissions, and consider using a dedicated WHOOP account or rotating credentials after testing. Recommended actions: obtain and review the whoop-auth/whoop-morning binaries (or request the author publish the full package), verify no unexpected network endpoints are contacted by those binaries, and only then provide your WHOOP credentials.

Type: OpenClaw Skill Name: whoop-morning Version: 0.1.1 The skill is designed to interact with the WHOOP API to fetch user data and provide suggestions. It handles OAuth tokens by requiring them as environment variables (`WHOOP_CLIENT_ID`, `WHOOP_CLIENT_SECRET`, `WHOOP_REFRESH_TOKEN`) and storing access tokens in a user-specific cache directory (`~/.cache/whoop-morning/tokens.json`) via `lib/tokens.js`. The `SKILL.md` provides clear setup instructions for the user, including an OAuth authorization flow, and does not contain any prompt injection attempts against the AI agent. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. All operations appear to be aligned with the stated purpose.