Beaver Habit Tracker

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Beaver Habits API wrapper, but it needs an API token and can read or update your habit completion data.

Before installing, make sure you are comfortable giving the skill a Beaver Habits API token that can read and update your habit records. The behavior is coherent with the advertised habit-tracking purpose, and no hidden code, persistence, or unrelated data access is shown in the provided artifacts.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone or anything using this token through the skill can read habit information and perform supported API actions on that Beaver Habits account.

Why it was flagged

The skill requires a permanent API token and uses it in Authorization headers to access the user's Beaver Habits account.

Skill content
`BEAVERHABITS_API_KEY` | Yes | — | Your permanent API token from the Beaver Habits settings page
Recommendation

Use a token intended for this purpose, keep it private, and revoke/regenerate it if you uninstall the skill or suspect exposure.

What this means

A habit could be marked complete or incomplete for a date when the user asks the agent to do so, including defaulting to today when no date is specified.

Why it was flagged

The skill documents a POST request that changes habit completion data. This is aligned with the tracker purpose and scoped to completions, but it is still a mutating API action.

Skill content
Mark a habit as done (or undone) for a specific date. ... curl -s -X POST ... /api/v1/habits/{habit_id}/completions
Recommendation

Phrase completion requests clearly and review the refreshed overview table after updates.