WHOOP Tracker

Access WHOOP fitness tracker data via API, including recovery scores, sleep metrics, workout stats, daily strain, and body measurements. Use when the user asks about their WHOOP data, fitness metrics, recovery status, sleep quality, workout performance, or wants to track health trends.

This skill is coherent with its stated purpose (fetching WHOOP data) and does not request unrelated credentials, but it is not production-ready. Before installing or running: (1) review the code locally — it will create ~/.whoop/credentials.json and ~/.whoop/token.json and store your client_id/client_secret and tokens there; protect those files (chmod 600 is recommended); (2) be prepared to run 'pip3 install requests' or use the provided install.sh in a virtualenv; (3) expect runtime errors due to documented bugs in AUDIT.md (fix import paths or run scripts from the skill root, ensure endpoints and redirect_uri match your WHOOP app settings); (4) if you don't trust the source, run the scripts in an isolated VM/container or review/fix the code before using them with your live WHOOP account. If you want, I can list the specific code mismatches and exact fixes referenced in AUDIT.md to help get it working safely.

Type: OpenClaw Skill Name: whoop-tracker Version: 1.0.1 The skill is designed to access WHOOP fitness data via its official API. All code and documentation align with this stated purpose. The `whoop_client.py` script handles OAuth authentication, token storage (`~/.whoop/token.json`), and API calls to legitimate WHOOP domains (`api.prod.whoop.com`). Credentials are stored securely in `~/.whoop/credentials.json` with `chmod 600` permissions. The `install.sh` script only installs the `requests` Python library and provides instructions for manual credential setup. The `SKILL.md` instructions are straightforward and do not contain any prompt injection attempts or instructions for malicious actions. The `AUDIT.md` file, while detailing numerous functional bugs, does not indicate any malicious intent or security vulnerabilities beyond poor implementation quality.