Whoop Skill

WHOOP CLI with health insights, trends analysis, and data fetching (sleep, recovery, HRV, strain).

This skill appears to do exactly what it says: run a WHOOP OAuth flow, store tokens locally, and call the WHOOP API. Before installing or running it: - Only provide WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET and WHOOP_REDIRECT_URI from your WHOOP developer app (these are needed for OAuth). Treat the client secret like any other secret. - Tokens are stored at ~/.whoop-cli/tokens.json with restrictive permissions (0o600); if you use shared machines or CI, consider where that file will live and who can read it. Revoke the refresh token from your WHOOP developer console if you suspect compromise. - The package is intended for npm install -g whoopskill; verify you install the official package name and review the GitHub source (https://github.com/koala73/whoopskill) if you want extra assurance. - Minor inconsistencies: registry metadata said instruction-only while the bundle contains source and an npm package; package-lock and package.json show slightly different versions — this is not an immediate red flag but worth verifying the release you install. - If you plan to run this in automation (cron/systemd), avoid embedding client secrets in widely-readable locations; prefer a protected environment and rotate credentials if needed.

Type: OpenClaw Skill Name: whoopskill Version: 1.1.0 The OpenClaw AgentSkills skill bundle for 'whoopskill' is benign. It provides a legitimate CLI tool for interacting with the WHOOP API, fetching health data, and managing OAuth tokens. The `SKILL.md` and `README.md` contain no prompt injection attempts, only clear instructions for usage and setup. The code handles sensitive credentials (WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET) via environment variables and stores OAuth tokens in `~/.whoop-cli/tokens.json` with appropriate `0o600` permissions. All network communication is directed to the legitimate WHOOP API (`https://api.prod.whoop.com/`), with no evidence of data exfiltration to unauthorized endpoints or malicious execution.