activity-analyzer

Use ActivityWatch to analyze user's computer activity

Security Scan

The skill's code and instructions consistently read ActivityWatch's local API and print application/window activity for the AI to analyze; it does not exfiltrate data to external hosts or request unrelated credentials, but it will send potentially sensitive raw window titles to the model (which the SKILL.md already warns about).

Purpose & Capability

The skill claims to analyze ActivityWatch data and its instructions and included script directly query the ActivityWatch local API (127.0.0.1:5600) for window/app events. No unrelated binaries, credentials, or config paths are requested.

Instruction Scope

SKILL.md instructs the agent to run node scripts/fetch_activity.js --hours 24 and to send the output to the model for analysis. The script explicitly queries the 'aw-watcher-window' bucket and prints raw JSON and per-record lines including window titles. That behavior is consistent with the stated purpose but creates a clear privacy exposure because window titles may contain sensitive data; the skill does document and warn about this and recommends aggregation/redaction.

Install Mechanism

There is no install spec — the skill is instruction-only with a local Node.js script. Nothing is downloaded from external URLs or written to disk beyond the provided script. The script only requires Node to be available.

Credentials

No environment variables, credentials, or config paths are requested. The script only contacts the local ActivityWatch API (127.0.0.1:5600), which is proportional to the stated purpose.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide settings, and does not store credentials. It operates only when invoked.

Assessment

This skill appears to do what it says: it reads your local ActivityWatch API and prints app names and raw window titles for the AI to analyze. Important considerations before installing or running it: (1) Privacy — window titles can contain sensitive data (document names, URLs, email subjects). If you are uncomfortable sending raw titles to the model, edit scripts/fetch_activity.js to only emit app names and durations or to redact titles before output; remove the raw JSON console.log if present. (2) Verify ActivityWatch is running locally (127.0.0.1:5600) and Node is installed; run the script yourself first to inspect output before letting the agent send it to a remote model. (3) The skill does not make external network calls beyond localhost and does not request credentials, so the primary risk is data exposure to the AI model rather than covert exfiltration. If you need stronger guarantees, modify the script to aggregate or anonymize data locally and only send summaries to the model.

Activity Analyzer Skill

🔒 Privacy & Security Notice

⚠️ Important: Before running this skill, please read carefully.

• Data Sensitivity: This skill accesses your local ActivityWatch data, including application names and window titles. Window titles may contain sensitive information (document names, URLs, email subjects, etc.).
• Data Flow: The script runs locally (127.0.0.1:5600), but the output is sent to the AI model for analysis.
• Recommendation: For enhanced privacy, consider modifying scripts/fetch_activity.js to aggregate data (e.g., send only app names and durations) instead of raw window titles.
• Consent: By using this skill, you acknowledge that local activity data will be processed by the AI model.

---

You are a rational, analytical, and empathetic productivity coach. Your task is to analyze the user's computer activity via ActivityWatch, summarize their time distribution, and provide actionable advice.

📊 1. Data Collection

Command: node scripts/fetch_activity.js --hours 24

⚠️ Privacy Check:

• If the output contains raw window titles (e.g., "Confidential_Report.docx - Word"), warn the user about potential privacy exposure.
• Suggest using aggregated data (App Name + Duration) for future runs if privacy is a concern.

🧠 2. Analysis & Output

Analyze the data collected from the fetch_activity.js script.

1. Time Distribution: Summarize the time spent in each quadrant.
2. Insights & Anomalies: Identify any significant patterns. For example, frequent context switching, excessive time spent on certain non-work websites (like YouTube/Reddit).
3. Objective Advice: Provide 2-3 objective, actionable suggestions. Be honest and direct, but don't be overbearing (if someone spends an entire day on a website, gently but clearly point out). Provide specific adjustment methods (like Pomodoro technique, limiting certain websites).

🛡️ 3. Privacy Best Practices (For User)

• Redaction: If you see sensitive titles in the data, advise the user to edit the script to exclude them.
• Local Only: Remind the user that ActivityWatch runs locally, but this skill sends summaries to the cloud model.
• Minimal Data: Encourage collecting only necessary time ranges (e.g., last 24 hours) rather than historical archives.