whoop-skill Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

whoop-skill is an AI agent skill, created by 4xiomdev and published at 4xiomdev/whoop-central. ClawSecure audited whoop-skill across 17 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 35 findings concentrate in Data Exfiltration, Policy Violation and Command Injection, including Pattern detected: from 'child_process' and Only 34% of skill content could be analyzed. 10 of 17 files are opaque.... 15 were rated high or critical severity.

Is whoop-skill safe?

ClawSecure audited whoop-skill and assigned a security score of 0/100 (High Risk), identifying 35 findings across Data Exfiltration and Policy Violation. Review the findings below before installing.

What did ClawSecure find in whoop-skill?

ClawSecure identified 35 findings in whoop-skill, concentrated in Data Exfiltration, Policy Violation and Command Injection. 15 were rated high or critical severity. The most severe include Pattern detected: from 'child_process' and Only 34% of skill content could be analyzed. 10 of 17 files are opaque....

How was whoop-skill audited?

ClawSecure ran whoop-skill through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 17 files from 4xiomdev/whoop-central.

What does a score of 0 mean?

ClawSecure assigned whoop-skill a security score of 0/100, placing it in the High Risk range. This is driven by 35 findings led by Data Exfiltration that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for whoop-skill

ClawSecure detected 35 security findings in whoop-skill, spanning Data Exfiltration, Policy Violation, Command Injection and Permissions Manifest.

critical · Pattern detected: from 'child_process'. Command Injection finding detected in src/auth.js:16.
high · Only 34% of skill content could be analyzed. 10 of 17 files are opaque.... Policy Violation finding.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/auth.js:120.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/auth.js:141.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/auth.js:224.
high · Pattern detected: fs.writeFileSync(. Data Exfiltration finding detected in src/auth.js:276.
high · Pattern detected: fs.writeFileSync(. Data Exfiltration finding detected in src/auth.js:286.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/auth.js:482.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/auth.js:507.
high · Pattern detected: fs.writeFileSync(. Data Exfiltration finding detected in src/auth.js:540.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/import-historical.js:44.
high · Pattern detected: fs.appendFileSync(. Data Exfiltration finding detected in src/import-historical.js:84.

Showing the 12 highest-severity of 35 findings. The full interactive list appears below.

3-Layer Audit Protocol

Security Recommendations for whoop-skill

Audit external network connections

whoop-skill sends data to external endpoints. Confirm each destination is expected and authorized, and remove any callback that exfiltrates data. ClawSecure monitors for known exfiltration and C2 endpoints.

Resolve policy violations

whoop-skill trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.

Harden command execution

whoop-skill constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Related Security Research

ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

awesome-openclaw-skillsScore 0/100 memUScore 0/100 understand-anythingScore 0/100 62ac696296b54aadScore 0/100 6bc837afc1a86e89Score 0/100

Scanned on May 2, 2026. whoop-skill is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan