Whoop Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:15 AM UTC
• Version: 1.1.0

Overview

This skill is a WHOOP health-data CLI that uses expected OAuth access and local token storage for its stated purpose.

Install only if you are comfortable granting access to sensitive WHOOP health and profile data. Keep WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET, ~/.whoop-cli/tokens.json, and CLI output off shared machines, logs, backups, and repositories; use whoopskill auth logout or revoke the app if access should stop.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill documentation indicates use of environment variables for OAuth credentials and network access to the WHOOP API, but no explicit permissions are declared in the skill itself. This creates a transparency and trust problem: users or hosts may not realize the skill can access secrets and make outbound requests, which increases the risk of unintended data exposure or misuse if the implementation is unsafe.

Description-Behavior Mismatch

Low

• Confidence: 94% confidence
• Finding: The CLI exposes commands to fetch additional sensitive WHOOP data types such as workout, cycle, profile, and body data that are not reflected in the declared skill metadata. This creates a transparency and consent gap: users or reviewers may approve the skill expecting narrower access while the code can retrieve more personal health data than advertised.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The README explicitly states that OAuth tokens are stored in ~/.whoop-cli/tokens.json and that the tool handles sensitive health and profile data, but it does not warn users that these artifacts may expose long-lived account access and private biometric information if the local system, home directory, backups, or logs are accessible to others. In a health-data CLI, this omission is security-relevant because users may run it on shared workstations, servers, cron hosts, or developer machines without understanding the sensitivity of the stored tokens and output.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that OAuth tokens are stored locally in ~/.whoop-cli/tokens.json with auto-refresh, but it does not provide a prominent warning about the sensitivity of those tokens or guidance on securing the file. Because this skill handles highly sensitive health and identity data, compromised tokens could allow unauthorized access to profile, sleep, recovery, and workout information.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.potential_exfiltration

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/auth/tokens.ts:23

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: src/auth/tokens.ts:40