Cycling Tracker Pro
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may advertise or require a network-capable command-line tool without explaining why, but there is no evidence it uses curl for hidden downloads or data transfer.
The skill metadata declares a curl dependency, but the registry requirements say no binaries are required and the SKILL.md/README.md do not describe any curl-based workflow. Curl is network-capable, so the unexplained dependency is worth noticing, though no artifact shows it being executed.
"requires":{"bins":["curl"]}Ask the publisher to remove the curl requirement or document exactly why it is needed before relying on it.