Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent local habit tracker that writes habit data and optional reports on the user's machine, with no evidence of network access, credential use, hidden execution, or destructive behavior.
Install only if you are comfortable with a local tracker creating and updating habit files under ~/.openclaw/workspace/habits/. Be careful when setting HABIT_DATA_DIR, --data-dir, or --output, because those paths control where files are read or written and report output may overwrite an existing file.
The skill can write local files and read environment-controlled paths, but it declares no explicit tool scope or permissions boundary. That makes its capabilities opaque to the invoking system and increases the chance of unintended file modification or abuse through permissive execution in a broader agent context.
The trigger list includes broad natural phrases such as 'habit', 'streak', 'morning routine', and 'did I exercise today', which can match ordinary conversation and invoke the skill unintentionally. In an agent system that can perform file writes, accidental invocation can lead to unwanted logging, habit changes, or report generation without clear user intent.
This code performs file writes to either the Obsidian vault or a user-provided output path. Although it prints a success message after writing, there is no prior warning or confirmation that an existing file may be overwritten, and the module docstring does not disclose that behavior explicitly.
No suspicious patterns detected.
