Habit Tracker Pro

习惯追踪专业版 - 习惯养成、打卡统计、成就系统

Security Scan

The skill's described habit-tracking functionality is plausible, but there are small but important mismatches (missing install/dependency declarations and an unknown source) that deserve caution before use.

Purpose & Capability

The SKILL.md and README describe a simple habit-tracker that invokes a 'clawhub' CLI (clawhub habit add/checkin/stats). That matches the stated purpose. However the package metadata (_meta.json) lists 'curl' as a required binary while the registry metadata and SKILL.md do not declare or explain this dependency, and there is no homepage or source repository to verify intent. The need for a 'clawhub' CLI is implied but not declared as a required binary.

Instruction Scope

Runtime instructions are limited to invoking the clawhub CLI for adding habits, checking in, and viewing stats — no instructions ask the agent to read local files or exfiltrate data. But the instructions assume an external CLI and likely network/cloud sync (pricing mentions cloud sync). That assumption is not documented in the declared requirements.

Install Mechanism

This is an instruction-only skill (no install spec). README suggests installing via 'npx clawhub@latest install habit-tracker-pro', which would run code from the npm registry at install time. That install path is not represented in declared install metadata, and _meta.json's 'requires.bins' differs from the registry's required-bins listing — an inconsistency that increases risk because an 'npx' installation executes remote package scripts.

Credentials

The skill requests no environment variables, no credentials, and no config paths. For a local habit tracker this is proportional. Be aware that optional cloud sync (mentioned in pricing) may require credentials at runtime, but none are declared here.

Persistence & Privilege

always is false and model invocation is not disabled (normal). The skill does not request persistent system-wide privileges or modify other skills. No elevated persistence behavior is declared.

What to consider before installing

This skill appears to be a simple wrapper around a 'clawhub' CLI, but there are inconsistencies and missing provenance: 1) Ask the publisher for the source repository or homepage so you can inspect the actual code before installing. 2) Verify whether you need the 'clawhub' CLI and/or 'curl' installed; the skill's metadata is inconsistent about required binaries. 3) Be cautious about using 'npx clawhub@latest install ...' because npx runs remote package code during install — inspect the package on the npm registry first. 4) If you plan to use cloud sync, confirm what credentials are needed and where your habit data is stored/shared. 5) If you cannot obtain a trustworthy source or package listing, avoid installing or running the CLI that this skill invokes.

习惯追踪专业版工具，帮你建立好习惯。

功能

• ✅ 习惯养成
• ✅ 打卡统计
• ✅ 成就系统
• ✅ 数据分析
• ✅ 社交分享

使用

# 添加习惯
clawhub habit add --name "早起" --frequency daily

# 打卡
clawhub habit checkin --name "早起"

# 统计数据
clawhub habit stats --name "早起" --days 30

# 成就系统
clawhub habit achievements

定价

版本	价格	功能
免费版	¥0	3 个习惯
Pro 版	¥39	无限习惯
订阅版	¥9/月	Pro+ 云同步