Glancely
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may install code from outside the reviewed skill artifact.
The skill relies on installing a Python package from the package ecosystem, and the provided metadata does not include a pinned install spec.
Install the package: `pip3 install glancely`
Install from a trusted package source, consider pipx or a virtual environment, and pin/verify the package version if possible.
Custom or modified tracker components can run Python code when used.
Normal use can execute local component scripts from tracker folders, which is expected for an extensible tracker framework but still worth noticing.
If exists read SKILL.md run log.py.
Only keep trusted components under ~/.glancely/components and review generated or manually edited scripts before relying on them.
Reminders or tracker prompts may continue running after setup according to cron configuration.
Cron support is disclosed and aligned with reminders, but it creates persistent scheduled agent activity using session-related configuration.
If user wants cron, ask for agent_id / session info and write `~/.glancely/openclaw.toml`
Enable cron only when you want persistent reminders, review the generated cron/session config, and remove or disable jobs you no longer need.
Using the diary feature may grant the tool access to a Google Calendar selected by the user.
The diary/calendar path uses user-provided Google OAuth credentials, which is expected for writing diary entries to a user-owned Google Calendar.
Google OAuth (user brings own client)
Use your own OAuth client, grant only the permissions needed, and avoid sharing token or credentials files.
The local Glancely data directory may contain sensitive habits, mood, diary, and reminder information.
The skill intentionally stores personal tracker entries, including raw mood replies, as persistent local data.
`mood` hourly check-ins with raw reply storage.
Keep GLANCE_HOME in a private location, be mindful of backups/sync tools, and delete stored data you no longer want retained.