Cycling Tracker Pro
PassAudited by ClawScan on May 10, 2026.
Overview
This instruction-only cycling tracker skill shows no malicious behavior, with only a minor metadata mismatch about an unused curl dependency.
This looks safe from the provided artifacts, but it appears to be mostly documentation rather than an implemented tracker. Before installing, verify why _meta.json lists curl as required and confirm the cycling commands actually exist.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may advertise or require a network-capable command-line tool without explaining why, but there is no evidence it uses curl for hidden downloads or data transfer.
The skill metadata declares a curl dependency, but the registry requirements say no binaries are required and the SKILL.md/README.md do not describe any curl-based workflow. Curl is network-capable, so the unexplained dependency is worth noticing, though no artifact shows it being executed.
"requires":{"bins":["curl"]}Ask the publisher to remove the curl requirement or document exactly why it is needed before relying on it.