Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

habit-tracker

v1.0.2

Build habits with streaks, reminders, and progress visualization

0· 66·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kirkraman/kirk-habit-tracker.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "habit-tracker" (kirkraman/kirk-habit-tracker) from ClawHub.
Skill page: https://clawhub.ai/kirkraman/kirk-habit-tracker
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kirk-habit-tracker

ClawHub CLI

Package manager switcher

npx clawhub@latest install kirk-habit-tracker
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (habit tracking, reminders, visualization) aligns with using an external NLP/analysis API (SkillBoss). However the registry metadata lists no required environment variables while the SKILL.md explicitly requires SKILLBOSS_API_KEY. That mismatch is unexpected and unexplained.
!
Instruction Scope
SKILL.md includes example code that sends user messages and habit data to https://api.skillboss.co/v1/pilot using SKILLBOSS_API_KEY. Yet the prose also says 'All data stored locally' — a direct contradiction. The instructions thus permit transmitting conversational/habit data externally, which is scope-relevant but not disclosed consistently.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. That is the lowest-risk install profile.
!
Credentials
The only runtime secret the skill needs is SKILLBOSS_API_KEY (proportionate for an external API). However the registry/metadata omitted this requirement while SKILL.md requires it — the omission is a notable inconsistency that could mislead users about secret sharing. Requesting an API key is otherwise reasonable for the stated functionality.
Persistence & Privilege
The skill does not request always:true, no install actions, and no config path access. It does allow autonomous invocation by default (platform normal), which combined with the external API access increases blast radius but is not by itself unusual.
What to consider before installing
This skill sends user messages and habit data to api.skillboss.co and requires an API key (SKILLBOSS_API_KEY) according to SKILL.md, but the registry metadata does not list that requirement and the README/README text claims 'All data stored locally' — which is inconsistent. Before installing: 1) Confirm with the publisher why the registry omits SKILLBOSS_API_KEY. 2) Decide whether you are comfortable sharing habit/conversation data with SkillBoss; review SkillBoss's privacy/security policy and vet the endpoint (https://api.skillboss.co). 3) Avoid supplying high-privilege secrets; provide only a limited API key or create a scoped/testing key first. 4) Prefer a skill with source code or an official homepage you can audit; ask the publisher for source or clarification. If the publisher cannot explain the metadata mismatch and the data-storage claim, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

aivk975ycbqr8cawq0qfg8dncnwyx84wmyqlatestvk975ycbqr8cawq0qfg8dncnwyx84wmyq
66downloads
0stars
2versions
Updated 1w ago
v1.0.2
MIT-0

Habit Tracker

Build lasting habits through conversation. Track streaks, get reminders, celebrate progress.

What it does

Creates and tracks daily/weekly habits, maintains streak counts, sends optional reminders, and visualizes your progress over time. Simple accountability through your AI assistant powered by SkillBoss API Hub.

Usage

Create habits:

"New habit: meditate daily"
"Track reading 30 minutes"
"Add habit: gym 3x per week"

Log completions:

"Did meditation"
"Completed reading"
"Hit the gym today"

Check progress:

"How are my habits?"
"Meditation streak"
"Weekly habit summary"

Set reminders:

"Remind me to meditate at 7am"
"Habit reminder at 9pm"

Habit Types

  • Daily: Must complete every day for streak
  • Weekly: Complete X times per week
  • Custom: Define your own cadence

Streak Rules

  • Miss a day = streak resets (daily habits)
  • Miss weekly target = week doesn't count
  • Say "skip [habit] today" to pause without breaking streak (limited uses)

Tips

  • Start with 1-2 habits, add more as they stick
  • Ask "habit insights" for pattern analysis
  • Say "archive [habit]" to stop tracking without deleting history
  • Morning check: "What habits do I need to do today?"
  • All data stored locally

API Integration

This skill uses SkillBoss API Hub for natural language understanding and habit analysis.

Environment variable required: SKILLBOSS_API_KEY

Example call:

import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

response = requests.post(
    "https://api.skillboss.co/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={
        "type": "chat",
        "inputs": {
            "messages": [
                {"role": "system", "content": "You are a habit tracking assistant."},
                {"role": "user", "content": user_message}
            ]
        },
        "prefer": "balanced"
    },
    timeout=60
)
reply = response.json()["result"]["choices"][0]["message"]["content"]

Comments

Loading comments...