The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches data from the official Oura Cloud API (api.ouraring.com) and sends notifications to the Telegram Bot API (api.telegram.org). These connections are necessary for the skill's primary functionality.
[DATA_EXFILTRATION]: While the skill sends health metrics to Telegram, this is a core feature configured by the user via their own TELEGRAM_CHAT_ID and bot tokens. No unauthorized data exfiltration was detected.
[CREDENTIALS_UNSAFE]: The skill requires an OURA_API_TOKEN and Telegram bot tokens. Instructions correctly advise users to store these in environment variables or secure local configuration files rather than hardcoding them.
[COMMAND_EXECUTION]: The skill includes several Python scripts and a shell wrapper for cron jobs. These are used for report generation and data management. No arbitrary or unsafe command execution patterns were found.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from the Oura API and formats it into text reports for the agent. While it lacks explicit boundary markers for API-sourced strings, the risk is minimal given the data originates from the user's private health account.
Ingestion points: oura_api.py fetches sleep, readiness, and activity data from the Oura Cloud API.
Boundary markers: Absent in reporting scripts.
Capability inventory: File writing (cache, Obsidian notes), Network access (Telegram).
Sanitization: No specific escaping or filtering of API-returned strings before formatting into reports.

oura-analytics