Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ouraskill
v1.0.3Syncs daily health and fitness data from Oura Ring into markdown files. Provides sleep, readiness, activity, heart rate, stress, SpO2, and workout data.
⭐ 0· 1.4k·3 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (sync Oura Ring data to markdown) matches the requested binary (uv) and the single required environment variable (OURA_TOKEN). The included Python script uses the oura_ring client library, which is appropriate for this purpose.
Instruction Scope
SKILL.md directs the agent to run the included script and to read/write files under {baseDir}/health/. It does not instruct reading unrelated system files, scanning other credentials, or sending data to endpoints other than the Oura API (accessed via the oura_ring library). Cron recommendation is local scheduling only.
Install Mechanism
This is instruction-only (no platform install spec). The Python script declares a dependency on the oura-ring package; uv (the runtime) will handle running/bringing in that dependency. There are no downloads from arbitrary URLs or obscure hosts in the skill bundle itself.
Credentials
Only OURA_TOKEN is required and declared as the primary credential; that is exactly what's needed to call the Oura API. No other secrets or unrelated environment variables are requested.
Persistence & Privilege
The skill is not always-on. disable-model-invocation is true (it cannot be invoked autonomously by the model), which reduces autonomous risk. The skill writes markdown files to its own health/ directory; it does not request elevated system-wide privileges or modify other skills' configs.
Assessment
This skill appears to do what it says: use your Oura personal access token to fetch data and write local markdown files. Before installing: (1) confirm you trust the skill source or review the full script (it's included) — the oura_ring dependency will be installed when running via uv, so verify that package on PyPI; (2) run it inside a dedicated directory or virtual environment and check the health/ files it writes; (3) when scheduling via cron, avoid embedding the token directly in world-readable crontabs — use a secure environment or a credential manager; (4) if you ever suspect misuse, revoke the Oura personal access token from your Oura account. Overall risk is low and required access is proportionate, but standard precautions (review dependency provenance and limit token exposure) are recommended.Like a lobster shell, security has layers — review code before you run it.
fitnessvk970hywtpwa02ybwgyfnemkxed80trhehealthvk970hywtpwa02ybwgyfnemkxed80trhelatestvk976r1bwhm22rb3va11rg6c3vx80ybkqouravk970hywtpwa02ybwgyfnemkxed80trhesleepvk970hywtpwa02ybwgyfnemkxed80trhewearablevk970hywtpwa02ybwgyfnemkxed80trhe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsuv
EnvOURA_TOKEN
Primary envOURA_TOKEN