ouraclaw

SUSPICIOUS. The skill's purpose and commands are internally consistent for fetching Oura sleep data, and no clear malicious exfiltration path is shown. However, it installs and runs a small third-party CLI from a mutable personal GitHub repo, then entrusts Oura OAuth tokens and health data to that code without pinning or release verification.