ClawAudit verdict
oura-ring-data
ouracli
The skill retrieves health and fitness data from the Oura Ring using the ouracli command-line interface. It requires authentication and does not contain any malicious code or intent.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (4)
<script> tag in markdown — potential code injection
src/ouracli/format_html.py · prose · downgraded · <script
Possible hardcoded credential
tests/test_client.py · prose · downgraded · token="test_token
Long base64 string (100+ chars) — likely obfuscated payload
tests/fixtures/activity_recent_14days.json · prose · downgraded · 22023332222233333222233322222222222222222223222222222222222222222222223322222222
Python os.getenv — reads environment variable
src/ouracli/client.py · prose · downgraded · os.getenv(
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.