Hydration Tracker

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may require local Bash/Python support even though the registry requirements do not declare it.

Why it was flagged

The implementation depends on Bash and Python, while the registry metadata declares no required binaries and no install spec. This can affect installation clarity, but the code is included and no remote download or hidden dependency is shown.

Skill content

#!/bin/bash ... python3 << 'PYEOF'

Recommendation

Confirm the CLI setup path and required local tools before relying on it; the publisher should align registry metadata with the documented Bash/Python requirements.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Anyone with access to your local account/files could potentially see your hydration history and goal data.

Why it was flagged

The skill persistently stores hydration intake and goal data in local JSON files. This is disclosed and purpose-aligned, but it is personal wellness data retained across sessions.

Skill content

DATA_DIR="$HOME/.water_reminder"
DATA_FILE="$DATA_DIR/data.json"
GOAL_FILE="$DATA_DIR/goal.json"
mkdir -p "$DATA_DIR"

Recommendation

Install only if local storage of this wellness data is acceptable; delete ~/.water_reminder if you want to remove the stored records.