Evenrealities Tracker

PassAudited by ClawScan on May 1, 2026.

Overview

This looks like a coherent order-status automation skill, but it stores order details locally, submits them to Evenrealities, and can run daily through a user-created cron job.

Before installing, confirm you are comfortable storing your email/order IDs in local memory files, submitting them to the Evenrealities tracking site on each run, installing Playwright browser components, and creating a cron job that keeps running until you remove it.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your order tracker may keep running daily and contacting the tracking site without asking each time.

Why it was flagged

The skill documents a persistent scheduled task that runs every morning. This is expected for daily order monitoring, but it means the automation continues after setup until the cron job is removed.

Skill content
clawdbot cron add ... --schedule "0 9 * * *" ... --task "python3 /Users/thibautrey/clawd/skills/evenrealities-tracker/scripts/tracker.py --check"
Recommendation

Only add the cron job if you want ongoing monitoring, verify the path is correct for your machine, and remove or disable the cron entry when you no longer need it.

What this means

Anyone or anything that can read or modify the memory files could see your order details or affect whether changes are detected.

Why it was flagged

The script stores order configuration and status history in persistent local memory files. This is part of the stated purpose, but those files contain personal order-tracking data and influence future change detection.

Skill content
self.config_file = self.memory_dir / "evenrealities-orders.json"
self.status_history = self.memory_dir / "evenrealities-status-history.json"
Recommendation

Keep the memory directory private, avoid storing unnecessary orders, and check the history file if alerts look wrong.

What this means

The configured order identifiers are sent to Evenrealities each time the check runs.

Why it was flagged

The script submits the configured email address and order ID to the Evenrealities tracking page. This is necessary for the tracker, but those identifiers may grant access to order-status information.

Skill content
page.goto('https://track.evenrealities.com', wait_until='networkidle') ... email_input.fill(email) ... order_input.fill(order_id)
Recommendation

Only add orders you intend to monitor, and treat the email/order ID combination as private order-access information.

What this means

Installing the skill dependencies can download and run third-party browser automation components.

Why it was flagged

The skill relies on an externally installed Python package and Playwright browser binaries, with a lower-bound version rather than an exact pinned version. This is expected for browser automation, but it is still a supply-chain consideration.

Skill content
playwright>=1.40.0
# 2. playwright install
#    (This downloads browser binaries - ~300-500MB)
Recommendation

Install dependencies in a trusted environment, consider pinning exact package versions, and review Playwright installation behavior if supply-chain control matters to you.