Nex Timetrack
v1.0.0Billable time logger for freelancers and agencies. Start/stop timers or log manually. Client and project management, rate cascading, 15-minute rounding, bill...
⭐ 0· 79·0 current·0 all-time
byNex AI@nexaiguy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the code and runtime instructions: a local Python CLI time-tracker using SQLite. Declared features (timers, clients, projects, exports, FTS search, 15-minute rounding) are implemented in the repository files. The only environment variable mentioned (NEX_TIMETRACK_DIR) directly relates to storage location and is reasonable for this purpose. One non-security inconsistency: licensing is inconsistent across SKILL.md (MIT-0), LICENSE.txt (AGPL-3.0), and README; this is a legal/licensing issue but does not affect runtime behavior.
Instruction Scope
SKILL.md instructs running setup.sh and using the CLI; the code and scripts operate on local files in ~/.nex-timetrack and create a wrapper in ~/.local/bin. The instructions and code do not attempt to read unrelated system configuration, other skills' credentials, or transmit data externally. The skill's claim 'No cloud, no telemetry' matches the visible code (no network calls in provided files).
Install Mechanism
There is no remote installer; setup.sh is included and is the intended install mechanism. setup.sh checks for Python 3.8+, creates ~/.nex-timetrack and exports, initializes the DB by invoking the included Python module, and writes a wrapper script into ~/.local/bin. This writes files to the user's home directory and places an executable in ~/.local/bin — expected for a CLI tool but worth noting because it modifies the user's PATH-adjacent location and creates persistent files.
Credentials
The skill does not require any credentials or external environment variables except an optional NEX_TIMETRACK_DIR to override the storage path. No tokens/keys/passwords are requested. The environment access requested is proportional to a local storage-centric CLI application.
Persistence & Privilege
The skill does create persistent data and a CLI wrapper in the user's home directory (~/.nex-timetrack and ~/.local/bin). always is false and model invocation is not disabled. These are standard for a user-installed local CLI but mean the skill will remain on disk and executable until the user removes it; users should be aware of that persistence.
Assessment
This appears to be a straightforward local time-tracker. Before installing: (1) review the included files yourself (they're local and human-readable) if you can, (2) note the licensing mismatch (SKILL.md vs LICENSE.txt) and decide which license you accept, (3) the setup script will create ~/.nex-timetrack and place a wrapper in ~/.local/bin — check that directory and add it to your PATH if needed, (4) run setup.sh in a controlled environment (or inspect it first); there are no network calls or secret-env requests in the provided code, so the privacy claim appears supported. If you need to restrict persistence, run the script manually without creating the wrapper or run the Python module directly from the source directory.Like a lobster shell, security has layers — review code before you run it.
latestvk976e3xceh5qa2xyvfv38sx3pd84aqmx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.