Cycling Tracker Pro

骑行追踪专业版 - 骑行记录、速度分析、路线规划

Security Scan

The skill appears to do what it claims (bike logging, analysis, routing) but has inconsistent metadata and installation guidance (references to curl, an undocumented 'clawhub' CLI, and an npx install command) that merit caution before installing or running code from unknown sources.

Purpose & Capability

The SKILL.md shows only cycling-related CLI commands (clawhub cycle ...), which match the stated purpose. However the packaged metadata (_meta.json) declares a dependency on 'curl', and the README recommends running 'npx clawhub@latest install cycling-tracker-pro' — neither of which are explained by the skill's description. The SKILL.md itself does not declare 'clawhub' as a required binary, yet all runtime examples depend on it.

Instruction Scope

The instructions are narrowly scoped to running the 'clawhub cycle' commands for logging, analysis, routing, and stats; they do not request environment variables, access to system files, or network endpoints in the SKILL.md. No steps instruct the agent to read unrelated files or exfiltrate data.

Install Mechanism

There is no formal install spec in the package (instruction-only), which is low-risk, but the README tells users to run 'npx clawhub@latest install cycling-tracker-pro' — invoking npx on an external package downloads and runs code from the npm registry and is a vector for arbitrary code execution if the publisher is untrusted. That install path is not documented in SKILL.md or declared in registry metadata.

Credentials

The skill does not request any environment variables or credentials, which is appropriate for a local tracking/analysis tool. There are no declared config paths. The only mismatch is that _meta.json lists a required binary 'curl' while SKILL.md examples require 'clawhub' — neither demands elevated credentials.

Persistence & Privilege

The skill is not set to always:true and does not request persistent or cross-skill configuration. Autonomous invocation is allowed (platform default) but this skill alone does not request elevated platform privileges.

What to consider before installing

This skill's functionality (ride logging, speed/route analysis) is aligned with its description, but there are inconsistencies you should resolve before installing: SKILL.md examples call a 'clawhub' CLI that is not listed as a required binary, _meta.json lists 'curl' as a requirement, and README suggests installing via 'npx', which downloads and runs code from npm. If you consider installing or running it: (1) confirm the official source/repository and author identity; (2) avoid running 'npx' on an unknown package unless you trust the publisher; (3) ask the maintainer to clarify the exact install steps and required binaries (is 'clawhub' required? why 'curl' is listed?); and (4) inspect the code distributed by the installer (or prefer installing from a vetted registry/official repo) before granting it execution on your machine.

骑行追踪专业版工具，帮你记录骑行旅程。

功能

• ✅ 骑行记录
• ✅ 速度分析
• ✅ 路线规划
• ✅ 训练计划
• ✅ 统计报告

使用

# 记录骑行
clawhub cycle log --distance 20 --time 60

# 速度分析
clawhub cycle speed --distance 20 --time 60

# 路线规划
clawhub cycle route --distance 30 --type "scenic"

# 查看统计
clawhub cycle stats --month 2026-04

定价

版本	价格	功能
免费版	¥0	基础功能
Pro 版	¥39	全部功能
订阅版	¥9/月	Pro+ AI 计划