WHOOP

WHOOP morning check-in (recovery/sleep/strain) with suggestions.

Security Scan

The skill's stated WHOOP purpose is plausible, but there are multiple internal inconsistencies (missing referenced scripts, mismatched metadata, undeclared runtime requirement, and instructions that write sensitive tokens to disk) that warrant caution before installing.

Purpose & Capability

The described purpose (fetch WHOOP recovery/sleep/strain and produce suggestions) matches the need for WHOOP OAuth credentials (client id/secret/refresh token). However the registry metadata claims no required env vars while SKILL.md explicitly lists WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, and WHOOP_REFRESH_TOKEN — an inconsistency in the skill manifest.

Instruction Scope

Runtime instructions tell a user to write secrets into ~/.clawdbot/.env and run node scripts under /home/claw/clawd/skills/whoop/bin/ (including an auth flow that writes the refresh token). Those file/path operations involve storing and reading long-lived credentials on disk and reference hard-coded absolute paths. The SKILL.md also references bin scripts that are not present in the supplied file manifest, which is a functional and security concern.

Install Mechanism

There is no install spec (instruction-only), which normally lowers risk. But the package includes a code file (lib/tokens.js) yet the runtime instructions require node and call missing bin scripts. The skill fails to declare 'node' (or another runtime) as a required binary. This mismatch suggests the package is incomplete or improperly packaged.

Credentials

Requesting WHOOP_CLIENT_ID/SECRET and a refresh token is proportionate for an OAuth-based WHOOP integration. However the SKILL.md expects secrets to be saved to ~/.clawdbot/.env (a local file with long-lived credentials) and the registry metadata does not list those env vars — that inconsistency and disk storage of refresh tokens should be considered before granting access.

Persistence & Privilege

The skill does not set always: true or disableModelInvocation; by default the model can invoke it and it will only run when invoked. That is typical, but bear in mind if you grant this skill credentials they will be available whenever the model calls it, so consider whether you want autonomous access to the stored WHOOP tokens.

What to consider before installing

This skill appears to implement a legitimate WHOOP integration, but there are several red flags you should resolve before installing: (1) SKILL.md lists required env vars (WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, WHOOP_REFRESH_TOKEN) but the registry metadata does not — confirm which is authoritative. (2) The instructions call node scripts at hard-coded paths (/home/claw/.../bin/...), yet those bin scripts are not present in the package; ask the author for the missing files or a proper install spec. (3) The skill expects you to store refresh tokens in ~/.clawdbot/.env — decide whether you are comfortable keeping long-lived tokens on disk and verify file permissions. (4) Ensure a node runtime is available and that any executable scripts are reviewed before running. If you proceed, request the missing bin scripts or a full, documented install, review their code (especially any network, file-write, or exec calls), and consider restricting automatic invocation if you do not want the model to access WHOOP credentials without explicit user action.

WHOOP morning check-in:

• fetches your latest WHOOP data (Recovery, Sleep, Cycle/Strain)
• generates a short set of suggestions for the day

Quick Start (User + Bot)

What the user does (one-time)

1. Create a WHOOP app and get credentials:

• WHOOP_CLIENT_ID
• WHOOP_CLIENT_SECRET

2. In the WHOOP developer dashboard, set Redirect URL:

• https://localhost:3000/callback

3. Put secrets into ~/.clawdbot/.env:

WHOOP_CLIENT_ID=...
WHOOP_CLIENT_SECRET=...

4. Authorize once (get refresh token):

node /home/claw/clawd/skills/whoop/bin/whoop-auth --redirect-uri https://localhost:3000/callback

• Open the printed URL on your phone/browser
• Tap Allow/Authorize
• Copy the code from the callback URL and paste it back

This writes WHOOP_REFRESH_TOKEN=... into ~/.clawdbot/.env.

What the bot does (each run)

Run:

node /home/claw/clawd/skills/whoop/bin/whoop-morning

Then send the output back to the user.

Automation (daily)

Recommended: schedule with Gateway cron (daily morning).

• Command: node /home/claw/clawd/skills/whoop/bin/whoop-morning
• Bot should send the output as a message.

Notes

• OAuth endpoints:
  • auth: https://api.prod.whoop.com/oauth/oauth2/auth
  • token: https://api.prod.whoop.com/oauth/oauth2/token
• Requires offline scope to receive refresh tokens.
• WHOOP rotates refresh tokens; the newest refresh token must be saved.