The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the whoop-pp-cli binary using npx from the @mvanhorn npm scope and go install from a GitHub repository owned by the author. These are identified as vendor-owned resources.
[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute remote installation commands (npx -y and go install) to fetch and set up the necessary CLI tools on the host system.
[COMMAND_EXECUTION]: The skill is designed to drive a local binary (whoop-pp-cli) using the Read Bash tool, executing various subcommands for data retrieval and configuration.
[DATA_EXFILTRATION]: The CLI includes a --deliver webhook:<url> feature that allows the agent to POST command results to an arbitrary network endpoint. Additionally, the feedback command can transmit data to a remote endpoint if WHOOP_FEEDBACK_ENDPOINT is configured.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Whoop API (e.g., workouts, sleeps, profile data).
Ingestion points: API data fetched via activity, cycle, and user commands (SKILL.md).
Boundary markers: The CLI uses a JSON provenance envelope (meta and results) to separate data from metadata.
Capability inventory: The skill possesses Read Bash capabilities to execute system commands.
Sanitization: No specific sanitization or filtering of external API content is documented before the agent processes the results.
[PERSISTENCE]: The skill includes instructions to register a Model Context Protocol (MCP) server (claude mcp add), which integrates the tool into the agent's persistent configuration across sessions.

pp-whoop