whoop
Fetches and analyzes WHOOP data on sleep, recovery, and workouts, providing insights for health and performance optimization.
Install this skill
Security score
The whoop skill was audited on Feb 9, 2026 and we found 26 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Ngrok tunnel reference
| 239 | ngrok http 3000 |
Ngrok tunnel reference
| 241 | # 2) Add the ngrok HTTPS URL + /callback to WHOOP dashboard Redirect URIs, then run: |
Ngrok tunnel reference
| 242 | WHOOP_REDIRECT_URI=https://YOUR-NGROK-DOMAIN.ngrok-free.app/callback node src/auth.js |
Access to hidden dotfiles in home directory
| 19 | # 1) One-time setup (writes ~/.clawdbot/whoop/credentials.json) |
Access to hidden dotfiles in home directory
| 91 | This writes `~/.clawdbot/whoop/credentials.json` (and optionally `token.json` if you paste tokens). |
Access to hidden dotfiles in home directory
| 145 | 5) Save tokens to `~/.clawdbot/whoop/token.json`: |
Access to hidden dotfiles in home directory
| 213 | rm ~/.clawdbot/whoop/token.json |
Access to hidden dotfiles in home directory
| 221 | - Copy the latest `access_token` + `refresh_token` from Postman into `~/.clawdbot/whoop/token.json` and update `obtained_at`. |
External URL reference
| 62 | - `openssl` (only needed for the optional `auth.js` flow when using `https://localhost`; Postman auth does not need it) |
External URL reference
| 72 | https://oauth.pstmn.io/v1/browser-callback |
External URL reference
| 76 | https://localhost:3000/callback |
External URL reference
| 100 | - `https://oauth.pstmn.io/v1/browser-callback` |
External URL reference
| 107 | https://oauth.pstmn.io/v1/browser-callback |
External URL reference
| 121 | https://api.prod.whoop.com/oauth/oauth2/auth |
External URL reference
| 125 | https://api.prod.whoop.com/oauth/oauth2/token |
External URL reference
| 151 | https://oauth.pstmn.io/v1/browser-callback |
External URL reference
| 166 | https://localhost:3000/callback |
External URL reference
| 171 | WHOOP_REDIRECT_URI='https://localhost:3000/callback' node src/auth.js |
External URL reference
| 176 | WHOOP_REDIRECT_URI='https://localhost:3000/callback' node src/auth.js --manual |
External URL reference
| 202 | https://oauth.pstmn.io/v1/browser-callback |
External URL reference
| 206 | https://localhost:3000/callback |
External URL reference
| 232 | - Redirect URI policy (WHOOP docs only mention `https://` or `whoop://` redirect URIs) |
External URL reference
| 242 | WHOOP_REDIRECT_URI=https://YOUR-NGROK-DOMAIN.ngrok-free.app/callback node src/auth.js |
External URL reference
| 250 | ### If your WHOOP Redirect URL is `https://localhost:3000/callback` |
External URL reference
| 255 | WHOOP_REDIRECT_URI=https://localhost:3000/callback node src/auth.js |
External URL reference
| 257 | It will generate a self-signed cert locally and your browser will likely show a warning for `https://localhost`. |
Install this skill with one command
/learn @openclaw/whoop-central