Security audit

WHOOP Central

Security checks for vulnerabilities and agentic risk

Overview

The skill is a transparent WHOOP data helper, but it stores OAuth tokens and health history locally, so users should protect those files.

Install only if you are comfortable granting WHOOP read scopes and keeping OAuth tokens plus health metrics in local JSON files. Use this on a trusted single-user machine, restrict permissions on ~/.clawdbot/whoop and ~/clawd/health/logs/whoop, avoid entering tokens in recorded/shared terminals, and revoke WHOOP tokens or delete local logs if you stop using it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/setup.js:17
Finding: OAuth secrets and sensitive health records are stored without restrictive filesystem permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/auth.js:385
Finding: OAuth callback reflects unescaped query parameters into an HTML response
Content: View full analysis
❌ Authorization Failed` + `
Error: ${error}
` + (errorDescription ? `
Description: ${errorDescription}
` : '') + (errorHint ? `
Hint: ${errorHint}
` : '') + `
Check the terminal for details.
` ); console.error(`\n❌ Authorization error: ${error}`); if (errorDescription) console.error(` Description: ${errorDescription}`); if (errorHint) console.error(` Hint: ${errorHint}`); server.close(); resolve(false); return; } ``` The listener is started without an explicit loopback address at `src/auth.js:438`: ```js server.listen(LISTEN_PORT, () => { ``` ### Technical Analysis The callback handler obtains `error`, `error_description`, and `error_hint` directly from request query parameters and interpolates them into an HTML response without context-appropriate escaping. An attacker can supply HTML elements or script content in these parameters, causing the browser to interpret the injected value as markup. The error branch is evaluated before the OAuth `state` comparison. Consequently, an attacker does not need to know the randomly generated OAuth state to reach the vulnerable rendering logic. The server also calls `listen()` without specifying a host. Depending on the Node.js and operating-system network configuration, this can bind to an unspecified address rather than exclusively to loopback. That increases exposure during the five-minute authentication window, particularly on shared or untrusted networks. No evidence shows that this origin directly exposes the stored token or credentials. Therefore, the demonstrated impact is constrained to script execution in ...[truncated 1484 chars]
Remediation: View remediation
{ // ... }); ``` 6. If public tunnel support is required, make non-loopback binding an explicit opt-in configuration. Clearly warn that the callback endpoint is then exposed through third-party infrastructure and must not render untrusted HTML. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (75)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This skill description emphasizes data retrieval, but the setup instructions prominently collect and store client credentials and OAuth tokens on disk. Undisclosed local secret storage is risky because operators may enable the skill without realizing it persists sensitive authentication material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This skill description emphasizes data retrieval, but the setup instructions prominently collect and store client credentials and OAuth tokens on disk. Undisclosed local secret storage is risky because operators may enable the skill without realizing it persists sensitive authentication material.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill explicitly writes credentials to ~/.clawdbot/whoop/credentials.json, which strongly suggests persistent local storage of secrets. Plain filesystem storage of client credentials is dangerous because other local users, backups, logs, or misconfigured permissions may expose them.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
Quick Commands

bash
# 1) One-time setup (writes ~/.clawdbot/whoop/credentials.json) node src/setup.js # 2) Recommended: Get tokens via Postman (see Auth section), then verify

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
node src/setup.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
node src/setup.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
node src/verify.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
node src/verify.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
node src/verify.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
md
node src/verify.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.
md
node src/verify.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
node src/today.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
node src/summary.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
node src/summary.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.
md
node src/summary.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
node src/recovery.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
node src/recovery.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
md
node src/recovery.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
node src/sleep.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
md
node src/sleep.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.
md
node src/sleep.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
node src/strain.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
node src/strain.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
node src/workouts.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
node src/workouts.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.
md
node src/workouts.js

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/auth.js:59

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/auth.js:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/import-historical.js:14

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/verify.js:12

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/auth.js:215

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/verify.js:36

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Credential Access

Quick Commands

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Static analysis

Shell command execution detected (child_process).

Environment variable access combined with network send.

Environment variable access combined with network send.

Environment variable access combined with network send.

Sensitive-looking file read is paired with a network send.

Sensitive-looking file read is paired with a network send.