Ouraskill

Syncs daily health and fitness data from Oura Ring into markdown files. Provides sleep, readiness, activity, heart rate, stress, SpO2, and workout data.

Security Scan

The skill's code, runtime instructions, and requested credential (OURA_TOKEN) are coherent with its stated purpose of syncing Oura Ring data into local markdown files.

Purpose & Capability

Name/description (sync Oura Ring data to markdown) matches the requested binary (uv) and the single required environment variable (OURA_TOKEN). The included Python script uses the oura_ring client library, which is appropriate for this purpose.

Instruction Scope

SKILL.md directs the agent to run the included script and to read/write files under {baseDir}/health/. It does not instruct reading unrelated system files, scanning other credentials, or sending data to endpoints other than the Oura API (accessed via the oura_ring library). Cron recommendation is local scheduling only.

Install Mechanism

This is instruction-only (no platform install spec). The Python script declares a dependency on the oura-ring package; uv (the runtime) will handle running/bringing in that dependency. There are no downloads from arbitrary URLs or obscure hosts in the skill bundle itself.

Credentials

Only OURA_TOKEN is required and declared as the primary credential; that is exactly what's needed to call the Oura API. No other secrets or unrelated environment variables are requested.

Persistence & Privilege

The skill is not always-on. disable-model-invocation is true (it cannot be invoked autonomously by the model), which reduces autonomous risk. The skill writes markdown files to its own health/ directory; it does not request elevated system-wide privileges or modify other skills' configs.

Assessment

This skill appears to do what it says: use your Oura personal access token to fetch data and write local markdown files. Before installing: (1) confirm you trust the skill source or review the full script (it's included) — the oura_ring dependency will be installed when running via uv, so verify that package on PyPI; (2) run it inside a dedicated directory or virtual environment and check the health/ files it writes; (3) when scheduling via cron, avoid embedding the token directly in world-readable crontabs — use a secure environment or a credential manager; (4) if you ever suspect misuse, revoke the Oura personal access token from your Oura account. Overall risk is low and required access is proportionate, but standard precautions (review dependency provenance and limit token exposure) are recommended.

Oura Ring

This skill syncs your daily health data from Oura Ring into readable markdown files.

Syncing Data

Sync today's data:

uv run {baseDir}/scripts/sync_oura.py

Sync a specific date:

uv run {baseDir}/scripts/sync_oura.py --date 2026-02-07

Sync the last N days:

uv run {baseDir}/scripts/sync_oura.py --days 7

Reading Health Data

Health files are stored at {baseDir}/health/YYYY-MM-DD.md — one file per day.

To answer health or fitness questions, read the relevant date's file from the {baseDir}/health/ directory. If the file doesn't exist for the requested date, run the sync command for that date first.

Cron Setup

Schedule the sync script to run every morning using OpenClaw's cron tool so your health data stays up to date automatically.