Baby Tracker
PassAudited by ClawScan on May 15, 2026.
Overview
This appears to be a purpose-aligned local baby-care tracker, but it will store sensitive baby and health information persistently on disk.
Before installing, be comfortable with the agent writing baby-care entries, imports, metadata, and generated charts under the configured local data directory. The artifacts do not show network exfiltration or credential use, but the stored records are private health-related information, so protect the folder and review entries when accuracy matters.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Short baby-care messages may be recorded to the local CSV log without a separate confirmation prompt when the agent considers them clear.
The skill instructs the agent to run local scripts that append records to the baby log from natural-language messages. This is expected for a tracker, but it is still local data mutation.
When a terse baby log message arrives: 1. Interpret the event type and details. 2. Append it immediately with the script.
Use this skill only when you want baby-care events recorded, and ask for confirmation or review events.csv when entries are ambiguous or important.
Baby health and care details can remain on disk and may be included in backups or visible to anyone with access to the user account or data directory.
The skill persistently stores baby metadata, care/health events, and sometimes raw original messages. This is disclosed and central to the skill, but it creates a sensitive local record.
`events.csv` — append-only flexible event log. - `metadata.json` — baby metadata (`name`, `date_of_birth`, `sex`, timezone, extra fields). ... Preserve the original user message in `--source-text` when helpful.
Keep the data directory protected, avoid including unnecessary sensitive notes, and manage backups or deletion according to your privacy needs.