WHOOP CLI for Agents

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:49 PM UTC
• Version: 0.5.2

Overview

This is a coherent WHOOP CLI helper skill with explicit credential safeguards, though users must trust a third-party npm CLI that can access sensitive health data.

Install only if you are comfortable trusting @andreasnlarsen/whoop-cli@0.5.2 with WHOOP account access and sensitive health data. Prefer Keychain or 1Password storage, avoid local-vps unless you accept its lower security, and review before using --force to write into agent skill directories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Global Installation of an Unverified Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–13 and 43–47
Vulnerability Type: Supply-chain exposure through a third-party dependency
Risk Level: Medium

Evidence

yaml

install:
  - kind: node
    package: "@andreasnlarsen/whoop-cli@0.5.2"
    bins:
      - whoop
    label: Install whoop-cli from npm

bash

npm install -g @andreasnlarsen/whoop-cli@0.5.2

Technical Analysis

The skill directs users or agents to globally install and execute the third-party npm package @andreasnlarsen/whoop-cli@0.5.2. The package version is pinned, which reduces version drift, but no package integrity hash, vendored source, lockfile, or independently auditable implementation is included in the reviewed project.

npm installation may execute package lifecycle scripts, including preinstall, install, and postinstall, with the permissions of the user performing the installation. A global installation also places the package's executable in a shared command location, extending trust beyond the immediate project. Because this CLI handles WHOOP authentication and sensitive health information, compromise of the package or its transitive dependency chain could expose valuable credentials and data.

The audited file does not demonstrate that the named package is malicious. The finding concerns the trust and supply-chain boundary created by automatically installing unaudited third-party code from an external registry.

Attack Path

1. An attacker compromises the specified npm package, its publisher account, the npm distribution path, or a transitive dependency used by the package.
2. The user or agent follows the bootstrap instruction and runs:

   bash

   npm install -g @andreasnlarsen/whoop-cli@0.5.2
   

3. npm downloads the external package and may execute its lifecycle scripts with the installing user's permissions.
4. Malicious installation or runtime code gains access to ...[truncated 1276 chars]

Remediation

View remediation

Remediation Suggestions

1. Provide auditable implementation material

   • Include the CLI source or a reviewed, reproducible artifact in the project.
   • Document the exact source repository, commit, build process, and release provenance corresponding to version 0.5.2.

2. Verify package integrity

   • Pin the expected npm integrity digest in a lockfile or installation manifest.
   • Verify the downloaded package tarball against a trusted checksum before installation.
   • Use npm provenance or signed release attestations where available.

3. Avoid global installation

   • Prefer a project-local installation with an exact lockfile.
   • Execute the package from a constrained project environment instead of placing its binary in a shared global command path.

4. Control lifecycle scripts

   • Review all required lifecycle scripts and transitive dependencies.
   • Use --ignore-scripts when the package does not require installation scripts.
   • If scripts are required, execute installation in an isolated environment with minimal filesystem, network, environment-variable, and credential access.

5. Apply runtime least privilege

   • Run the CLI as a non-administrative user.
   • Restrict access to unrelated files, credentials, and agent directories.
   • Keep credential storage isolated and ensure the CLI receives only the minimum secrets needed for its operation.

6. Continuously monitor the dependency

   • Audit the package and its transitive dependency tree before updates.
   • Monitor publisher ownership changes, unexpected release activity, known vulnerabilities, and integrity changes.
   • Require explicit review before changing the pinned package version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

- Linux/OpenClaw preferred secret storage is 1Password CLI with a service account.
- Linux/OpenClaw simple fallback is explicit `local-vps` storage with `--accept-local-vps-risk`.
- Profile JSON at `~/.whoop-cli/profiles/<profile>.json` stores non-secret metadata only.
- Keychain access uses macOS Security APIs through `/usr/bin/swift`; do not replace this with command-line secret arguments.
- If `/usr/bin/swift` is unavailable, tell the user to install Apple Command Line Tools with `xcode-select --install`.
- If a sandboxed agent shell cannot access macOS Keychain, rerun the `whoop` command with normal user permissions; do not use secret-bearing command-line arguments as a fallback.
- After login, regular read commands should not need passwords or Touch ID.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- Linux/OpenClaw preferred secret storage is 1Password CLI with a service account.
- Linux/OpenClaw simple fallback is explicit `local-vps` storage with `--accept-local-vps-risk`.
- Profile JSON at `~/.whoop-cli/profiles/<profile>.json` stores non-secret metadata only.
- Keychain access uses macOS Security APIs through `/usr/bin/swift`; do not replace this with command-line secret arguments.
- If `/usr/bin/swift` is unavailable, tell the user to install Apple Command Line Tools with `xcode-select --install`.
- If a sandboxed agent shell cannot access macOS Keychain, rerun the `whoop` command with normal user permissions; do not use secret-bearing command-line arguments as a fallback.
- After login, regular read commands should not need passwords or Touch ID.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

## Security + Credential Handling

- Never ask users to paste long-lived client secrets or tokens into chat.
- For first-time auth, have the user run login locally in their own shell.
- macOS default secret storage is macOS Keychain.
- Linux/OpenClaw preferred secret storage is 1Password CLI with a service account.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- If `/usr/bin/swift` is unavailable, tell the user to install Apple Command Line Tools with `xcode-select --install`.
- If a sandboxed agent shell cannot access macOS Keychain, rerun the `whoop` command with normal user permissions; do not use secret-bearing command-line arguments as a fallback.
- After login, regular read commands should not need passwords or Touch ID.
- If macOS asks for "password data for new item" during login, stop and update or reinstall `whoop`; the CLI should write Keychain items non-interactively.
- On Linux, do not silently fall back to plaintext profile JSON. Use `onepassword` or explicit `local-vps`.
- Do not send long-lived 1Password service-account tokens through Telegram. In simple `local-vps` setup, the expected Telegram handoff is the short-lived WHOOP auth URL and redirected callback URL.
- Prefer read-only operational commands in agent flows: `summary`, `day-brief`, `health`, `trend`, and `sync pull`.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

whoop skill install --target agents --force

text

That writes `~/.agents/skills/whoop-cli/SKILL.md` and links it into `~/.codex/skills/whoop-cli`.

Install for OpenClaw when needed:

Static analysis

No suspicious patterns detected.