Oura API Complete Export

• Risk level: Low
• Analyzed: Mar 2, 2026, 5:03 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code, instructions, and requested artifacts align with its stated purpose (performing Oura OAuth and exporting Oura v2 usercollection endpoints); it stores OAuth client secrets/tokens locally and writes exported JSON files, which is expected behavior.

This skill appears to do exactly what it says: perform an OAuth authorization with Oura, save tokens locally, and export API data to JSON. Before installing/running: (1) review the included scripts yourself (they're small and readable); (2) be aware the client_secret and tokens will be written to ~/.config/oura-oauth/config.json (the script sets restrictive perms, but keep that file private); (3) only run the auth flow on a trusted machine and use a local redirect URI as documented; (4) ensure python3 and the requests package are installed; (5) restrict the OAuth app scopes to only what's necessary and rotate the client_secret if you later suspect compromise; and (6) do not upload the config file or exported JSON to untrusted services as they contain sensitive personal data.