wahoo-cloud
Accesses Wahoo Fitness Cloud API to fetch and analyze workout data, parsing metrics into a local SQLite database for insights.
Install this skill
Security score
The wahoo-cloud skill was audited on May 14, 2026 and we found 22 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 89 | ```bash |
Template literal with variable interpolation in command context
| 98 | ```bash |
Template literal with variable interpolation in command context
| 115 | ```bash |
Template literal with variable interpolation in command context
| 130 | ```bash |
Curl to non-GitHub URL
| 131 | curl -s -X POST https://api.wahooligan.com/oauth/token \ |
Access to hidden dotfiles in home directory
| 21 | | "Show recent rides" / "Last week's training" | Query `~/.openclaw/workspace/training/wahoo.db` (or `$WAHOO_TRAINING_DIR/wahoo.db`) — schema below | |
Access to hidden dotfiles in home directory
| 30 | **Credential auto-loading:** if `WAHOO_CLIENT_ID` / `WAHOO_CLIENT_SECRET` aren't in the calling shell, `wahoo_auth.py` automatically reads them from `~/.openclaw/secrets/wahoo.env` (override path with |
Access to hidden dotfiles in home directory
| 44 | Add to `~/.clawdbot/clawdbot.json`: |
Access to hidden dotfiles in home directory
| 75 | The script prints an authorization URL. Open it in a browser, log in with your Wahoo account, approve. You'll be redirected to your callback URL with `?code=...` in the query string (the page itself w |
Access to hidden dotfiles in home directory
| 80 | python3 ~/.openclaw/workspace/training/fetch_wahoo.py |
Access to hidden dotfiles in home directory
| 83 | This pulls the workout list, fetches detail (and FIT URL) for each new workout, downloads FIT files into `~/.openclaw/workspace/training/wahoo_fit/`, parses them, and upserts records into `~/.openclaw |
Access to .env file
| 30 | **Credential auto-loading:** if `WAHOO_CLIENT_ID` / `WAHOO_CLIENT_SECRET` aren't in the calling shell, `wahoo_auth.py` automatically reads them from `~/.openclaw/secrets/wahoo.env` (override path with |
External URL reference
| 4 | homepage: https://cloud-api.wahooligan.com/ |
External URL reference
| 12 | API base: `https://api.wahooligan.com`. Workout endpoints live under `/v1/workouts`. OAuth2 with the `offline_data` scope yields a long-lived refresh token; access tokens expire after ~2 hours and the |
External URL reference
| 36 | 1. Go to https://developers.wahooligan.com |
External URL reference
| 38 | 3. Set callback URL (e.g. `https://localhost:8080/` — the manual-paste OAuth helper works with any registered callback) |
External URL reference
| 54 | "WAHOO_REDIRECT_URI": "https://localhost:8080/" |
External URL reference
| 66 | export WAHOO_REDIRECT_URI="https://localhost:8080/" |
External URL reference
| 91 | "https://api.wahooligan.com/v1/workouts?page=1&per_page=30" |
External URL reference
| 100 | "https://api.wahooligan.com/v1/workouts/WORKOUT_ID" |
External URL reference
| 117 | "https://api.wahooligan.com/v1/user" |
External URL reference
| 131 | curl -s -X POST https://api.wahooligan.com/oauth/token \ |