ClawHub
Back to skill

Security audit

Whoop Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a WHOOP health-data CLI that uses expected OAuth access and local token storage for its stated purpose.

Install only if you are comfortable granting access to sensitive WHOOP health and profile data. Keep WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, ~/.whoop-cli/tokens.json, and CLI output off shared machines, logs, backups, and repositories; use whoopskill auth logout or revoke the app if access should stop.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill documentation indicates use of environment variables for OAuth credentials and network access to the WHOOP API, but no explicit permissions are declared in the skill itself. This creates a transparency and trust problem: users or hosts may not realize the skill can access secrets and make outbound requests, which increases the risk of unintended data exposure or misuse if the implementation is unsafe.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The CLI exposes commands to fetch additional sensitive WHOOP data types such as workout, cycle, profile, and body data that are not reflected in the declared skill metadata. This creates a transparency and consent gap: users or reviewers may approve the skill expecting narrower access while the code can retrieve more personal health data than advertised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The README explicitly states that OAuth tokens are stored in ~/.whoop-cli/tokens.json and that the tool handles sensitive health and profile data, but it does not warn users that these artifacts may expose long-lived account access and private biometric information if the local system, home directory, backups, or logs are accessible to others. In a health-data CLI, this omission is security-relevant because users may run it on shared workstations, servers, cron hosts, or developer machines without understanding the sensitivity of the stored tokens and output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that OAuth tokens are stored locally in ~/.whoop-cli/tokens.json with auto-refresh, but it does not provide a prominent warning about the sensitivity of those tokens or guidance on securing the file. Because this skill handles highly sensitive health and identity data, compromised tokens could allow unauthorized access to profile, sleep, recovery, and workout information.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.potential_exfiltration

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
src/auth/tokens.ts:23

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
src/auth/tokens.ts:40