Ouraskill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:33 PM UTC
• Version: 1.0.3

Overview

This skill appears intended to sync Oura Ring health data, but it should be reviewed because it stores sensitive records locally and gives weak guidance for protecting the token and scheduled sync.

Review this before installing if your Oura data is sensitive. Use a private output directory, keep generated health files out of shared workspaces, backups, cloud sync, and version control unless intended, store the Oura token through OpenClaw secret handling rather than directly in crontab, and consider pinning or locking the oura-ring dependency before enabling scheduled sync.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/sync_oura.py:1

Finding

Unpinned Third-Party Dependency Handles Sensitive Credentials and Health Data

Content

View full analysis

Vulnerability Details

File Location: scripts/sync_oura.py:1-4
Vulnerability Type: Unpinned runtime dependency
Risk Level: Medium

python

# /// script
# requires-python = ">=3.10"
# dependencies = ["oura-ring"]
# ///

Technical Analysis

The inline dependency declaration allows uv run to resolve and execute an unrestricted version of the third-party oura-ring package. The project provides neither an exact version constraint nor a lockfile with integrity data.

The package is imported as OuraClient at line 13 and receives the long-lived OURA_TOKEN at lines 466-475. It also processes the user's sleep, readiness, activity, stress, heart-rate, SpO2, and workout records. Therefore, a package release installed after this audit may have access to both the authentication credential and sensitive health information.

This does not prove that the current package is malicious. The vulnerability is the lack of reproducible, integrity-controlled dependency resolution for a security-sensitive component.

Attack Path

1. An attacker compromises the upstream package, its maintainer account, or its release process.
2. The attacker publishes a malicious version that still satisfies the unrestricted oura-ring dependency declaration.
3. The user invokes the documented uv run scripts/sync_oura.py command, or a scheduled synchronization invokes it automatically.
4. uv resolves and executes the malicious package version.
5. The dependency reads OURA_TOKEN, intercepts returned health information, or executes other code with the permissions of the account running the Skill.

Impact Assessment

Successful exploitation could disclose the Oura personal access token and private health records. The malicious dependency would execute with the invoking user's operating-system privileges and could access other files and environment variables available to that process.

The project itself does not req ...[truncated 283 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin oura-ring to an exact, reviewed version rather than allowing unrestricted resolution.
2. Commit a uv lockfile containing the complete transitive dependency graph and integrity information.
3. Run scheduled synchronization in locked or frozen mode so it fails instead of silently selecting a new dependency release.
4. Review dependency updates before changing the pin, including the package's network destinations, token handling, and transitive dependencies.
5. Where supported, isolate the synchronization process with access only to the required token, output directory, and Oura network endpoints.
6. Establish a token-revocation procedure for suspected dependency compromise.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:85

Finding

Long-Lived Oura Token Embedded in Persistent Cron Configuration

Content

View full analysis

Vulnerability Details

File Location: README.md:85-90
Vulnerability Type: Plaintext sensitive credential in scheduled-task configuration
Risk Level: Medium

markdown

### Cron

Schedule the sync to run every morning so your data stays up to date automatically. OpenClaw's `cron` tool can handle this, or use a system crontab:

```bash
0 7 * * * OURA_TOKEN="..." uv run /path/to/ouraskill/scripts/sync_oura.py

text

### Technical Analysis

The documented crontab example places `OURA_TOKEN` directly in persistent cron configuration. Users are likely to replace the placeholder with their actual personal access token. The README states that this token does not expire unless revoked, increasing the consequences of unnoticed disclosure.

Crontab files are persistent configuration and may be exposed through privileged inspection, backups, support bundles, configuration exports, or accidental sharing. Embedding a secret directly in the command also makes secure rotation and centralized secret management more difficult.

Scheduled daily synchronization is consistent with the Skill's declared functionality. The project does not automatically install a cron job, service, or other persistence mechanism, so the schedule itself is not an undisclosed backdoor. The confirmed issue is the insecure credential-storage pattern recommended for that optional schedule.

### Attack Path

1. A user follows the README and replaces `...` with a real Oura personal access token.
2. The token is stored persistently in the user's crontab.
3. Another local administrator, backup reader, diagnostic collector, or recipient of an accidentally shared crontab obtains the configuration.
4. The attacker extracts the plaintext token.
5. The attacker uses it against the Oura API to retrieve health information until the user revokes the token.

### Impact Assessment

Exposure could grant unauthorized access to the victim's Oura records, includ
...[truncated 375 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the example that embeds OURA_TOKEN directly in the crontab command.
2. Prefer OpenClaw's secret-management and environment-injection facilities for scheduled runs.
3. If a credential file is unavoidable, store it outside the repository, restrict it to the owning account, and document appropriate filesystem permissions.
4. Avoid placing the token in shell command text, logs, source files, or broadly readable environment files.
5. Document token rotation and immediate revocation through Oura's personal-access-token interface after suspected disclosure.
6. Recommend running the scheduled task under a dedicated, non-privileged account with access only to the required output directory and secret.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

md

## Auth notes

Oura uses personal access tokens — no SSO, no Cloudflare, no token caching needed. The token doesn't expire unless you revoke it. Get yours at https://cloud.ouraring.com/personal-access-tokens.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

env: ["OURA_TOKEN"]
    config:
      - id: oura_token
        label: Oura Personal Access Token
        type: secret
        env: OURA_TOKEN
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly describes syncing highly sensitive health data into local markdown files, but it does not warn users that these files may be readable by other local users, included in backups, indexed by search tools, or accidentally committed to source control. Because the data includes sleep, stress, heart rate, SpO2, and workout information, omission of privacy guidance creates a real confidentiality risk even if there is no malicious behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The cron section encourages unattended daily collection and storage of health data without clearly warning that this creates ongoing background accumulation of sensitive records. In the context of health telemetry, silent long-term collection increases privacy exposure because users may forget the job exists while data continues to grow in local storage and backups.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill can access an environment secret and write files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for users or the platform to understand and constrain what the skill is allowed to do, especially given that it handles sensitive health data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to sync health data into local markdown files without warning that this creates persistent plaintext copies of sensitive personal health information. Users may unknowingly expose sleep, heart rate, stress, SpO2, and workout data to backups, local indexing, other tools, or shared workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cron guidance encourages automatic recurring collection and storage of personal health data, but it does not warn users about the privacy implications of continuous retention. Automating this process increases exposure because data accumulates over time and may be copied into backups, logs, synced folders, or multi-user systems without the user appreciating the scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.