Productivity Tracker

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent local task, habit, and pomodoro tracker with no evidence of networking, credential access, or hidden behavior.

This skill appears reasonable for local productivity tracking. Before installing, be aware that your tasks and habits will be saved locally under ~/.task-tracker, and provenance information is limited because the source and homepage are not provided.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI06: Memory and Context Poisoning

What this means

Your task names, habit names, completion dates, and related local records may remain on your computer after use.

Why it was flagged

The skill creates persistent local files for tasks and habits. This is expected for the stated tracker, but those records may contain private productivity or habit information.

Skill content

DATA_DIR = Path.home() / ".task-tracker"
TASKS_FILE = DATA_DIR / "tasks.json"
HABITS_FILE = DATA_DIR / "habits.json"

Recommendation

Avoid storing secrets in task or habit names, and delete ~/.task-tracker if you want to remove the skill's local data.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less external context for verifying the publisher or project history.

Why it was flagged

The registry provides limited provenance information. The supplied code itself is simple and self-contained, so this is a verification note rather than evidence of malicious behavior.

Skill content

Source: unknown
Homepage: none

Recommendation

Install only if you trust the registry entry or have reviewed the included source code.