Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real Whoop integration, but it handles sensitive health-account credentials in risky ways that users should review before installing.
Install only if you are comfortable granting ongoing read access to your Whoop health data. Prefer the local OAuth exchange flow, do not send authorization codes or tokens through Telegram, WhatsApp, or other chats, protect ~/.whoop_token and ~/.whoop_refresh_token, and revoke the Whoop app if those files or codes may have been exposed.
print("\n" + "=" * 70)
print("✅ SUCCESS! Access token received")
print("=" * 70)
print(f"\n🔑 Access Token:\n{access_token[:20]}...{access_token[-20:]}")
if refresh_token:
print(f"\n🔄 Refresh Token:\n{refresh_token[:20]}...{refresh_token[-20:]}")# Save both access and refresh tokens
DEFAULT_TOKEN_FILE.write_text(access_token)
print(f"\n💾 Access token saved to: {DEFAULT_TOKEN_FILE}")
if refresh_token:
refresh_file = DEFAULT_TOKEN_FILE.parent / ".whoop_refresh_token"refresh_file = DEFAULT_TOKEN_FILE.parent / ".whoop_refresh_token"
refresh_file.write_text(refresh_token)
print(f"💾 Refresh token saved to: {refresh_file}")
print("\n✨ Refresh token will auto-renew your access token when it expires!")
print("\n" + "=" * 70)
print("🎉 SETUP COMPLETE!")
print("=" * 70)1. Go to https://app.whoop.com/ 2. Navigate to Settings → Developer 3. Create a new application 4. Complete OAuth flow to get access token 5. Store token in `~/.whoop_token` or set `WHOOP_API_TOKEN` environment variable
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.