Huckleberry

ReviewAudited by ClawScan on May 1, 2026.

Overview

Huckleberry is a coherent instruction-only CLI guide for baby tracking, with disclosed but sensitive use of an unofficial package and Huckleberry account credentials.

Before installing, remember this is an unofficial Huckleberry CLI. Verify the package source, authenticate only if you trust it, and double-check child name, activity type, amounts, units, and measurements before running logging commands.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

You would be trusting a third-party package to run locally and interact with a baby-tracking account.

Why it was flagged

The skill asks the user to install an external, unofficial CLI package; this is disclosed and central to the skill, but package provenance and version pinning are not provided in the artifacts.

Skill content
> **Note:** This is an unofficial tool and is not affiliated with Huckleberry. ... `pip install huckleberry-cli`
Recommendation

Install only if you trust the package source; consider verifying the package, version, and dependency provenance before authenticating.

What this means

The CLI can access the user's Huckleberry account and child-related profile or tracking data.

Why it was flagged

The CLI requires Huckleberry account authentication and can persist account configuration locally; this is expected for the stated purpose but involves sensitive credentials.

Skill content
Config stored at `~/.config/huckleberry/config.json`. ... `HUCKLEBERRY_EMAIL` ... `HUCKLEBERRY_PASSWORD`
Recommendation

Authenticate only if you trust the CLI, avoid storing passwords in shell history or shared profiles, and protect the local config file.

What this means

Incorrect child names, amounts, units, or measurements could create inaccurate baby-care records.

Why it was flagged

These commands save baby-tracking records to the Huckleberry account; they are purpose-aligned but mutate personal account data.

Skill content
`huckleberry sleep stop`, `huckleberry feed bottle <amount>`, `huckleberry diaper both`, `huckleberry growth --weight=7.5`
Recommendation

Use these commands only for explicit user requests and confirm child, activity type, amount, units, and timing before logging.