ClawHub
Back to skill

Security audit

WHOOP Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WHOOP API helper that reads fitness and profile data, with manageable risks around local OAuth secret storage and dependency installation.

Install only if you are comfortable granting read access to WHOOP health, workout, sleep, recovery, profile, and body-measurement data. Keep `~/.whoop/credentials.json` and `~/.whoop/token.json` private, avoid using this on shared machines, revoke tokens if exposed, and consider installing dependencies in a virtual environment with pinned packages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/install.sh:5
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/whoop_client.py:67
Finding

Credential and OAuth Token Files Are Secured Only After Writing

Content
View full analysis
~/.whoop/credentials.json < ~/.whoop/credentials.json <
Remediation
View remediation
~/.whoop/credentials.json <

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (44)

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The documentation directs users to place a client secret in a plaintext file under the home directory. Even with restrictive file permissions, plaintext secret storage creates credential exposure risk through backups, accidental sharing, local compromise, or other tools reading the file.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

2. Save Credentials

bash
mkdir -p ~/.whoop
cat > ~/.whoop/credentials.json <<EOF
{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 318)May include surrounding context.

md
## Error Responses

### 401 Unauthorized
Access token is invalid or expired. Refresh the token.

### 429 Too Many Requests
Rate limit exceeded. Check `Retry-After` header.

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The documentation instructs users to store a client secret in plaintext in ~/.whoop/credentials.json. Even with local permissions, plaintext secret storage increases the risk of credential disclosure through local compromise, backups, accidental sharing, or insecure endpoint environments.

Content

Scanner excerpt · references/oauth.md (reported line 14)May include surrounding context.

  1. Save credentials locally:
    bash
    mkdir -p ~/.whoop
cat > ~/.whoop/credentials.json <<EOF
{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

This step finalizes creation of a local credentials file containing the client secret, confirming persistent plaintext secret storage on disk. While common in developer examples, this still expands the attack surface for secret theft from the user's machine.

Content

Scanner excerpt · references/oauth.md (reported line 20)May include surrounding context.

"client_secret": "YOUR_CLIENT_SECRET" } EOF chmod 600 ~/.whoop/credentials.json

text

## Authorization Flow

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The documentation states that access and refresh tokens are automatically saved to ~/.whoop/token.json, meaning bearer credentials are persisted locally. Refresh tokens are especially sensitive because theft can allow long-lived unauthorized API access until revocation or expiry.

Content

Scanner excerpt · references/oauth.md (reported line 60)May include surrounding context.

text

This exchanges the code for:
- **Access token**: Used for API requests (expires after ~1 hour)
- **Refresh token**: Used to get new access tokens

Tokens are automatically saved to `~/.whoop/token.json`.

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

This finding reflects the same behavior: storage and reuse of bearer tokens capable of authenticating to the WHOOP API. Persisting such tokens without stronger safeguards increases the risk of account data exposure if the local environment is compromised.

Content

Scanner excerpt · references/oauth.md (reported line 61)May include surrounding context.

md
This exchanges the code for:
- **Access token**: Used for API requests (expires after ~1 hour)
- **Refresh token**: Used to get new access tokens

Tokens are automatically saved to `~/.whoop/token.json`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/oauth.md (reported line 69)May include surrounding context.

md
### Automatic Refresh

The `WhoopClient` automatically refreshes expired access tokens using the refresh token when a 401 response is received.

### Manual Refresh

Credential Access

High
Category
Privilege Escalation
Confidence
76% confidence
Finding

The troubleshooting section reinforces storing client_id and client_secret in a local plaintext file, normalizing a weaker secret-management practice. Repetition in docs can lead users to adopt insecure long-term storage without considering safer alternatives.

Content

Scanner excerpt · references/oauth.md (reported line 101)May include surrounding context.

md
## Troubleshooting

### "Credentials not found"
Create `~/.whoop/credentials.json` with your client_id and client_secret.

### "Not authenticated"
Run `client.authenticate(code)` with a valid authorization code first.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/oauth.md (reported line 117)May include surrounding context.

md
- Never commit credentials or tokens to version control
- Store credentials with restricted permissions (`chmod 600`)
- Refresh tokens are long-lived but can be revoked by the user
- Access tokens expire after ~1 hour and must be refreshed

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT.md (reported line 175)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT.md (reported line 188)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT.md (reported line 288)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT.md (reported line 296)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT.md (reported line 338)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 14)May include surrounding context.

sh
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 15)May include surrounding context.

sh
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/whoop_client.py (reported line 22)May include surrounding context.

python
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/whoop_client.py (reported line 45)May include surrounding context.

python
echo "  1. Register an app at https://developer.whoop.com"
echo "  2. Create credentials file:"
echo "     mkdir -p ~/.whoop"
echo '     echo '"'"'{"client_id": "YOUR_ID", "client_secret": "YOUR_SECRET"}'"'"' > ~/.whoop/credentials.json'
echo "     chmod 600 ~/.whoop/credentials.json"
echo ""
echo "  3. Complete OAuth authorization (see references/oauth.md)"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AUDIT.md (reported line 94)May include surrounding context.

md
self.refresh_token = refresh_token

    def _is_token_expired(self) -> bool:
        """Check if the access token is expired or about to expire."""
        if not self.token_expires_at:
            return False
        # Treat as expired 60 seconds before actual expiry

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/whoop_client.py (reported line 88)May include surrounding context.

python
self.refresh_token = refresh_token

    def _is_token_expired(self) -> bool:
        """Check if the access token is expired or about to expire."""
        if not self.token_expires_at:
            return False
        # Treat as expired 60 seconds before actual expiry

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/whoop_client.py (reported line 98)May include surrounding context.

python
self.refresh_token = refresh_token

    def _is_token_expired(self) -> bool:
        """Check if the access token is expired or about to expire."""
        if not self.token_expires_at:
            return False
        # Treat as expired 60 seconds before actual expiry

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/whoop_client.py (reported line 124)May include surrounding context.

python
self.refresh_token = refresh_token

    def _is_token_expired(self) -> bool:
        """Check if the access token is expired or about to expire."""
        if not self.token_expires_at:
            return False
        # Treat as expired 60 seconds before actual expiry

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · AUDIT.md (reported line 182)May include surrounding context.

markdown
1. **Register Application**:
   - Go to https://developer.whoop.com
   - Create new app, get `client_id` and `client_secret`
   - Set redirect URI (e.g., `http://localhost:8080/callback`)

2. **Save Credentials**:

Static analysis

No suspicious patterns detected.