Cycling Tracker Pro
AdvisoryAudited by VirusTotal on Apr 22, 2026.
Overview
Type: OpenClaw Skill Name: cycling-tracker-pro Version: 1.0.0 The skill bundle consists entirely of metadata and documentation (SKILL.md, README.md) for a cycling tracking tool. There is no executable code, suspicious command logic, or prompt injection attempts present in the provided files (_meta.json, SKILL.md, README.md).
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may advertise or require a network-capable command-line tool without explaining why, but there is no evidence it uses curl for hidden downloads or data transfer.
The skill metadata declares a curl dependency, but the registry requirements say no binaries are required and the SKILL.md/README.md do not describe any curl-based workflow. Curl is network-capable, so the unexplained dependency is worth noticing, though no artifact shows it being executed.
"requires":{"bins":["curl"]}Ask the publisher to remove the curl requirement or document exactly why it is needed before relying on it.