Habit Tracker Pro

习惯追踪专业版 - 习惯养成、打卡统计、成就系统

Security Scan

The skill appears to do what its description says (habit tracking) but contains small metadata and install inconsistencies (undeclared required CLI, a curl requirement in _meta.json, and an install hint via npx) that warrant caution before installing.

Purpose & Capability

The SKILL.md usage matches a habit-tracking tool (clawhub habit add/checkin/stats/achievements), which is consistent with the name/description. However, the skill references the 'clawhub' CLI in instructions but the registry metadata at the top lists no required binaries; conversely _meta.json lists 'curl' as a required binary. The actual required binary (clawhub) is not declared, and curl is declared without explanation. This mismatch is unexpected and should be clarified.

Instruction Scope

Runtime instructions are limited to running clawhub CLI commands for adding habits, checking in, and viewing stats/achievements. They do not ask the agent to read unrelated files, access environment variables, or transmit data to arbitrary endpoints in the SKILL.md content.

Install Mechanism

There is no formal install spec in the registry entry (instruction-only), but README suggests installing via `npx clawhub@latest install habit-tracker-pro`. That implies fetching code from the npm ecosystem at install time. Combined with the _meta.json 'curl' requirement, this is inconsistent and raises a moderate risk: the README's npx install will execute code pulled from the network, so you should inspect that remote package before running it.

Credentials

The skill does not declare or request any environment variables, credentials, or config paths. This is proportionate for a local CLI-driven habit tracker. There is no evidence in SKILL.md of access to other secrets or unrelated credentials.

Persistence & Privilege

The skill is not marked always:true and is user-invocable only. There are no code files or install hooks in the package itself that request elevated or persistent privileges. Autonomous invocation is enabled by default on the platform but that alone is not a red flag here.

What to consider before installing

This skill appears to be a simple habit-tracker, but there are small inconsistencies you should resolve before installing: (1) The runtime examples expect a 'clawhub' CLI, yet the skill metadata doesn't declare that binary—confirm you already have a trusted clawhub installation. (2) _meta.json lists 'curl' as required and the README recommends installing via `npx clawhub@latest install habit-tracker-pro`, which would fetch and run remote code—inspect the npm package (or the clawhub installer) before running it. (3) If the Pro/云同步 (cloud sync) features will upload your habit data, ask where data is stored and what endpoints are used. If you cannot verify the origin/trustworthiness of the clawhub/npx package or the cloud backend, avoid running the npx install and request a reputable source or the package contents for review.

习惯追踪专业版工具，帮你建立好习惯。

功能

• ✅ 习惯养成
• ✅ 打卡统计
• ✅ 成就系统
• ✅ 数据分析
• ✅ 社交分享

使用

# 添加习惯
clawhub habit add --name "早起" --frequency daily

# 打卡
clawhub habit checkin --name "早起"

# 统计数据
clawhub habit stats --name "早起" --days 30

# 成就系统
clawhub habit achievements

定价

版本	价格	功能
免费版	¥0	3 个习惯
Pro 版	¥39	无限习惯
订阅版	¥9/月	Pro+ 云同步