Step
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a local step-tracking skill that stores wellness entries on the user's machine without evidence of network access, credential use, or hidden behavior.
This skill looks safe for ordinary local step tracking. Before installing, confirm how the `step` command is created because no install spec is declared, and remember that your wellness entries are stored locally in plaintext under `~/.local/share/step/`.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your step counts, goals, reminders, and related wellness notes may remain on disk until you delete them.
The skill keeps persistent local records of step and wellness-related activity. This is disclosed and aligned with the purpose, but it may include personal health data.
All data is stored locally at `~/.local/share/step/`. Each action is logged with timestamps.
Install only if you are comfortable storing this wellness data locally; review or delete `~/.local/share/step/` if you no longer want the history retained.
The skill may require manual setup or a separate command wrapper, so users should understand what script is being installed before using it.
The package includes a shell script and documentation for a `step` command, but the registry metadata does not describe how that command is installed or invoked.
No install spec — this is an instruction-only skill. Code file presence: scripts/script.sh
Verify the installation path and command wrapper for `step` before use, and prefer running only the included reviewed script from a location you control.