Productivity Tracker
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a coherent local task, habit, and pomodoro tracker with no evidence of networking, credential access, or hidden behavior.
This skill appears reasonable for local productivity tracking. Before installing, be aware that your tasks and habits will be saved locally under ~/.task-tracker, and provenance information is limited because the source and homepage are not provided.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your task names, habit names, completion dates, and related local records may remain on your computer after use.
The skill creates persistent local files for tasks and habits. This is expected for the stated tracker, but those records may contain private productivity or habit information.
DATA_DIR = Path.home() / ".task-tracker" TASKS_FILE = DATA_DIR / "tasks.json" HABITS_FILE = DATA_DIR / "habits.json"
Avoid storing secrets in task or habit names, and delete ~/.task-tracker if you want to remove the skill's local data.
You have less external context for verifying the publisher or project history.
The registry provides limited provenance information. The supplied code itself is simple and self-contained, so this is a verification note rather than evidence of malicious behavior.
Source: unknown Homepage: none
Install only if you trust the registry entry or have reviewed the included source code.