Gamification & XP System

XP system for productivity gamification via ClawdBot - track levels, badges, streaks, and achievements

Security Scan

The skill claims to be a ClawdBot-facing gamification interface but contains multiple inconsistencies and requests sensitive Supabase credentials (service role key) without justification or the expected API configuration.

Purpose & Capability

The description says this is a ClawdBot prompt interface that talks to a ClawdBot API server, but the skill asks for direct Supabase credentials (SUPABASE_URL and SUPABASE_SERVICE_KEY). The registry metadata earlier listed no required env vars while SKILL.md declares two required env vars — an internal inconsistency. The SKILL.md also references backend files (api-server/src/...) that are not present in the package, which is misleading.

Instruction Scope

Instructions describe HTTP endpoints on a ClawdBot API server, but do not declare or explain CLAWDBOT_API_URL or any API auth mechanism. At the same time the skill requires a Supabase service role key (full DB privileges) even though the documented runtime flow shows the agent talking to an API server rather than the DB directly. This ambiguity expands the agent's scope and could enable direct DB access/exfiltration if the service key is used.

Install Mechanism

No install spec or code files are provided (instruction-only), so there is no install-time code execution risk. This lowers risk but makes the other inconsistencies more important because the skill is purely declarative.

Credentials

Requesting SUPABASE_SERVICE_KEY (service role key) is disproportionate for a skill that nominally calls a ClawdBot API server. A service role key grants broad DB privileges (can bypass RLS, read/write all tables) and is highly sensitive; the SKILL.md does not justify why this key is needed. Additionally, the registry metadata did not advertise required env vars, so required secrets are not transparent.

Persistence & Privilege

The skill is not always-enabled and is user-invocable only; it does not request persistent system-level privileges or claim to modify other skills. No elevated persistence privileges are declared.

What to consider before installing

This skill has several red flags you should resolve before installing or providing secrets: (1) Ask the publisher why the skill needs SUPABASE_SERVICE_KEY (a supabase service_role key has full DB access). For a user-facing gamification skill, the agent should normally call a ClawdBot API (which enforces access control); it should not require a service_role key. (2) Request the CLAWDBOT_API_URL and the expected API authentication method; the SKILL.md refers to API endpoints but gives no base URL or auth instructions. (3) Verify provenance: there is no homepage or source and the skill references backend files that aren't bundled — ask for the server code or a trusted deployment URL so you can audit it. (4) If you must provide credentials, prefer the narrowest-scoped API key (not service_role), store it server-side (not in many agents), and rotate keys afterwards. (5) If the publisher cannot justify direct DB access or provide source code/a trustworthy deployment, treat this skill as too risky to grant secrets to.

Turn productivity into a game with XP, levels, badges, streaks, and achievements. Every completed task, habit, and goal milestone earns XP toward leveling up.

ClawdBot Integration

This skill is designed for ClawdBot - it provides the prompt interface for ClawdBot's gamification API server which stores data in Supabase.

Architecture:

User → ClawdBot Gateway → ClawdBot API Server → Supabase (Postgres)
                         (Railway)              (user_gamification, xp_transactions tables)

The backend implementation lives in api-server/src/routes/gamification.ts and api-server/src/lib/xp-engine.ts.

Features

• XP System: Earn XP for habits, tasks, and goal milestones
• Leveling: Level up with formula XP = 50 * (level^2)
• Streak Bonuses: Up to 2.0x multiplier for consistent habits
• Badges: Earn badges for achievements and milestones
• Leaderboard: Compare progress (multi-user support)
• Accountability: Track commitment and earn-back system

Environment Variables

Variable	Required	Description
SUPABASE_URL	Yes	Supabase project URL
SUPABASE_SERVICE_KEY	Yes	Supabase service role key

API Endpoints

All endpoints are relative to the ClawdBot API server ({CLAWDBOT_API_URL}/api/gamification/).

Get User Stats

GET /api/gamification/stats/:userId

Response:

{
  "totalXp": 2450,
  "currentLevel": 7,
  "weeklyXp": 350,
  "monthlyXp": 1200,
  "progress": {
    "xpInLevel": 150,
    "xpNeeded": 450,
    "percent": 33
  },
  "accountability": {
    "balance": 50,
    "totalSlashed": 10,
    "totalEarnedBack": 60
  }
}

Get Recent Transactions

GET /api/gamification/transactions/:userId?limit=20

Get User Badges

GET /api/gamification/badges/:userId

Award XP (Internal)

POST /api/gamification/award
{
  "userId": "302137836",
  "amount": 50,
  "source": "habit",
  "sourceId": "morning-routine",
  "note": "Completed morning routine"
}

Complete Habit (with streak bonus)

POST /api/gamification/habit-complete
{
  "userId": "302137836",
  "habitId": "workout",
  "currentStreak": 7
}

Complete Task

POST /api/gamification/task-complete
{
  "userId": "302137836",
  "taskId": "task-123",
  "priority": 8
}

Goal Milestone

POST /api/gamification/goal-milestone
{
  "userId": "302137836",
  "goalId": "goal-456",
  "milestonePercent": 50
}

Award Badge

POST /api/gamification/badge
{
  "userId": "302137836",
  "badgeType": "early_bird",
  "metadata": { "streak": 30 }
}

Get Leaderboard

GET /api/gamification/leaderboard

Get XP Config

GET /api/gamification/config

Database Tables

This skill requires the following Supabase tables:

• user_gamification - User XP totals, levels, streaks
• xp_transactions - XP award history
• user_badges - Earned badges

XP Rewards

Action	Base XP	Notes
Habit completion	10-50	+ streak bonus up to 2x
Task completion	5-50	Based on priority (1-10)
Goal 25% milestone	100	First quarter
Goal 50% milestone	200	Halfway
Goal 75% milestone	300	Three quarters
Goal 100% completion	500	Full completion

Example Usage

Check Progress

"What's my XP level?"
"How close am I to leveling up?"
"Show my gamification stats"

View Achievements

"What badges do I have?"
"Show my recent XP transactions"
"What's my current streak?"

Leaderboard

"Show the leaderboard"
"Who has the most XP?"

Related

• goals - Set and track goals
• habits - Habit tracking system
• remind - Reminder system
• daily-briefing - Daily progress summary