Code Card Sync

Sync your AI coding stats to Code Card - beautiful, shareable developer profiles

Security Scan

The skill's requirements and instructions are consistent with its stated purpose (syncing coding stats to Code Card); it is an instruction-only skill that runs the official-looking npm CLI via npx and reads a local config file for the Code Card API key.

Purpose & Capability

Name/description (sync to Code Card) match what the SKILL.md does: it requires Node/npx and runs the 'code-card' npm CLI. Requested binaries (node, npx) are appropriate for this task and there are no unrelated credential requests or odd config paths.

Instruction Scope

Runtime instructions are narrow and focused: check ~/.claude/.codecard for CC_API_KEY, run 'npx code-card@latest' to authenticate, and run 'npx code-card@latest sync' to sync. The only file referenced is a plausible local config for storing the Code Card API key; no unrelated system files, broad data collection, or off-domain endpoints are referenced.

Install Mechanism

No install spec (instruction-only) — lowest surface for persistent installs. However the instructions rely on 'npx' which fetches and executes code from the npm registry at runtime; this is expected for CLI tools but introduces a moderate supply-chain/execution risk compared with a preinstalled, audited binary.

Credentials

The skill declares no required environment variables and does not request unrelated credentials. It checks a single config file (~/.claude/.codecard) for CC_API_KEY which is coherent for storing a Code Card API key.

Persistence & Privilege

always:false and no install behavior are set; the skill does not request persistent elevated privileges or to modify other skills or system-wide settings. Recommended cron entries are advisory only.

Assessment

This skill is internally consistent with its purpose, but a few practical cautions before you install/use it: - npx executes a package downloaded from npm each time; review the 'code-card' package page and repository (npm: https://www.npmjs.com/package/code-card, site: https://www.codecard.dev) to ensure it is the expected project and maintained by a trusted author. - The SKILL.md checks ~/.claude/.codecard for CC_API_KEY. Confirm you want your Code Card API key stored/read from that file and that it doesn't accidentally contain other secrets. - If you are security-conscious, instead of directly running npx from the agent, manually install the package locally (npm i -g code-card or inspect the package contents) and audit its code before running it. Running it in an isolated environment (container/VM) reduces risk. - The cron example uses a 'cron add' helper which may not exist on all systems; it is advisory. If you automate runs, prefer a method you control and verify (system cron, CI runner) and avoid embedding secrets in world-readable locations. If you want a deeper evaluation, provide the code/repo URL for the 'code-card' npm package or paste the CLI script contents so I can inspect what it does when it runs and how it handles your API key.

Sync your AI coding stats (Claude Code, Codex, OpenClaw) to Code Card - beautiful, shareable developer profiles.

First-Time Setup

Check if already configured:

cat ~/.claude/.codecard 2>/dev/null

If it prints CC_API_KEY=cc_..., skip to the Sync section.

If not configured, run:

npx code-card@latest

This will print a URL and a code like:

Go to:     https://www.codecard.dev/link
Enter code: ABCD-1234

Tell the user to visit that URL and enter the code in their browser. They will log in or create an account there. Once they complete it, the CLI finishes automatically and syncs all sessions.

Sync

Incremental sync (fast, only new sessions):

npx code-card@latest sync -i

Full resync (recomputes everything):

npx code-card@latest sync

Other Commands

Command	What it does
npx code-card@latest stats	Show stats summary
npx code-card@latest profile	Open profile in browser

Recommended Cron Schedule

Daily incremental + weekly full:

cron add --name "code-card-daily" --schedule "0 6 * * *" --tz "America/New_York" --isolated --message "Run an incremental Code Card sync by executing: npx code-card@latest sync -i"

cron add --name "code-card-weekly" --schedule "0 7 * * 0" --tz "America/New_York" --isolated --message "Run a full Code Card sync by executing: npx code-card@latest sync"

More Info

• Website: https://www.codecard.dev
• npm: https://www.npmjs.com/package/code-card
• Requires Node.js 18+