Healthcheck Litiao

Track water and sleep with JSON file storage

Security Scan

The skill's stated purpose (local JSON health tracking) is plausible, but the runtime instructions omit a declared Node.js dependency and embed unsanitized user input into node -e one-liners that can enable code injection or arbitrary file writes.

Purpose & Capability

Name and description match the behavior in SKILL.md (read/write a local JSON file for water/sleep tracking). However the instructions assume a Node.js runtime is available (they run node -e), but the skill declares no required binary; that mismatch should be corrected or explained.

Instruction Scope

Instructions tell the agent to execute node -e one-liners that read and write {baseDir}/health-data.json only — which is fine for the stated task — but they directly interpolate user-supplied values (CUPS, NEW_CUPS) into JavaScript executed on the shell. Without explicit input validation/sanitization this can allow code injection or breaking of the command. The SKILL.md also leaves {baseDir} unspecified, so a bad substitution could cause writes to arbitrary filesystem locations.

Install Mechanism

No install spec (instruction-only), which minimizes install-time risk. Still, runtime relies on Node.js; absence of declared runtime requirement is a correspondence problem (should list node as a required binary).

Credentials

The skill requests no environment variables, credentials, or config paths — that is proportionate for a local JSON-based health tracker.

Persistence & Privilege

always is false and the skill does not request permanent/global privileges or modify other skills. It writes a local data file in {baseDir}, which is expected for its purpose but needs a safe default path.

What to consider before installing

This skill is ostensibly a simple local health tracker, but before installing consider: (1) It runs inline node -e commands — ensure the agent environment actually has Node.js available or the skill should declare it. (2) The one-liners insert user input (CUPS, NEW_CUPS) directly into code executed by the shell; this can allow code injection if inputs aren't strictly validated. Ask the author to replace these with safe handlers (parse numbers before executing, avoid interpolating raw user text into node -e strings, or provide a proper code file that safely parses and validates input). (3) Confirm what {baseDir} will be (set it to a restricted workspace) so the skill cannot overwrite sensitive files. (4) If you don't control the agent runtime or can't enforce input validation and a safe base directory, do not enable this skill.

Health Tracker

Simple tracking for water intake and sleep using JSON file.

Data Format

File: {baseDir}/health-data.json

{
  "water": [{"time": "ISO8601", "cups": 2}],
  "sleep": [{"time": "ISO8601", "action": "sleep|wake"}]
}

Add Water Record

When user says "uống X cốc" or "uống nước X cốc":

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d={water:[],sleep:[]};try{d=JSON.parse(fs.readFileSync(f))}catch(e){}d.water.push({time:new Date().toISOString(),cups:CUPS});fs.writeFileSync(f,JSON.stringify(d));console.log('Da ghi: '+CUPS+' coc')"

Replace CUPS with number from user input.

Add Sleep Record

When user says "đi ngủ":

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d={water:[],sleep:[]};try{d=JSON.parse(fs.readFileSync(f))}catch(e){}d.sleep.push({time:new Date().toISOString(),action:'sleep'});fs.writeFileSync(f,JSON.stringify(d));console.log('Da ghi: di ngu')"

Add Wake Record

When user says "thức dậy" or "dậy rồi":

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d={water:[],sleep:[]};try{d=JSON.parse(fs.readFileSync(f))}catch(e){}const last=d.sleep.filter(s=>s.action==='sleep').pop();d.sleep.push({time:new Date().toISOString(),action:'wake'});fs.writeFileSync(f,JSON.stringify(d));if(last){const h=((new Date()-new Date(last.time))/3600000).toFixed(1);console.log('Da ngu: '+h+' gio')}else{console.log('Da ghi: thuc day')}"

View Stats

When user says "thống kê" or "xem thống kê":

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d={water:[],sleep:[]};try{d=JSON.parse(fs.readFileSync(f))}catch(e){}console.log('Water:',d.water.length,'records');console.log('Sleep:',d.sleep.length,'records');const today=d.water.filter(w=>new Date(w.time).toDateString()===new Date().toDateString());console.log('Today:',today.reduce((s,w)=>s+w.cups,0),'cups')"

Update Record

To update last water entry:

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d=JSON.parse(fs.readFileSync(f));d.water[d.water.length-1].cups=NEW_CUPS;fs.writeFileSync(f,JSON.stringify(d));console.log('Updated')"

Delete Record

To delete last water entry:

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d=JSON.parse(fs.readFileSync(f));d.water.pop();fs.writeFileSync(f,JSON.stringify(d));console.log('Deleted')"

Notes

• Uses Node.js built-in modules only
• File auto-created if missing
• All timestamps in ISO8601 format