Security audit
Health Habit Builder
Security checks across malware telemetry and agentic risk
Overview
The skill's code, instructions, and requirements are consistent with a local habit-planning and tracking tool — it does not request secrets, external network access, or unusual installs.
This skill appears to do what it says: local habit evaluation, micro-habit generation, tracking, and motivation analysis implemented in plain Python with no network calls or secret access. Before installing or enabling it in an agent: (1) confirm you are comfortable that data is stored only in-memory (the skill does not persist or sync by itself — data will be lost between runs unless the platform provides storage); (2) review the code if you plan to run it on a sensitive host (it will execute Python on the agent runtime); (3) do not treat its recommendations as medical advice — it is behavioral tooling, not a clinician; (4) if you need cloud sync or backups, expect to add secure, explicit storage and authorization rather than giving this skill broad credentials. Overall, the package is internally coherent and shows no signs of exfiltration or unrelated privileges.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.