WHOOP Health Data Sync

This skill appears to do what it says (sync WHOOP -> markdown), but there are three things you should check before installing or running it: 1) Remove or inspect the included data/tokens.json: the package contains an access_token and refresh_token. If those tokens are valid, they grant access to WHOOP data. Do NOT install/run with those tokens present; delete or replace tokens.json and run auth.py yourself to create fresh tokens. 2) Expect undeclared dependencies: the scripts invoke the 1Password CLI ('op') and curl via subprocess. Ensure you understand whether you want the skill to access your 1Password vault or a local .op-token file (it looks for ~/.openclaw/.op-token). If you don't use 1Password, set WHOOP_CLIENT_ID/WHOOP_CLIENT_SECRET as environment variables and make sure curl/op aren't available to the runtime if you want to prevent that code path. 3) Sensitive data persistence & automation: the skill stores refresh tokens on disk (allows long-lived access) and writes health reports to ~/.openclaw/workspace/health — consider whether you want those files present on the machine and ensure correct file permissions and that automated cron tasks are scheduled only on machines you trust. Additional recommendations: inspect auth.py and sync.py locally (they are human-readable), regenerate WHOOP client secrets if you accidentally used any included tokens, and only run this skill on a trusted device. If you need help verifying whether the provided tokens are live, do not paste them here — instead, remove the file and run an auth flow yourself.