Habit Flow

What to consider before installing Habit Flow - Confirm install method: the registry metadata claimed "instruction-only" but the package contains code and an INSTALL.md. Install by cloning the repo into your gateway workspace (~/clawd/skills or ~/.clawdbot/skills) and run npm install as documented — do not treat it as a metadata-only skill. - Review scripts that interact with the system before enabling them: specifically scripts/sync_reminders.ts, scripts/run_reminder.ts, and any example shell helpers in examples/*.sh. Reminders create cron entries via the gateway; the skill moved to opt-in cron creation, but you should inspect what cron jobs will be created and confirm they call only the intended wrappers. - Data is stored locally at ~/clawd/habit-flow-data/. Back up or inspect that directory if you want to preserve or audit your habit data. The skill will read/write config.json in that directory and update activePersona when switching personas. - Dependencies: npm install will fetch public npm packages (including @napi-rs/canvas which requires native build tooling). If you want to avoid native builds, do not enable canvas/dashboard features. - Gateway/WhatsApp configuration: WhatsApp reminders rely on your gateway's configured channel; the skill does not itself hold WhatsApp credentials. Ensure your gateway's channel config is secure and understood. - Small metadata oddities (SKILL.md install metadata listing node/npm as bins, and registry claiming no install spec) look like packaging/metadata mistakes rather than malicious behavior. If you need higher assurance: (1) run the skill in a sandboxed workspace, (2) inspect package.json and scripts for any network calls or unexpected subprocess invocations, and (3) grep for use of eval/spawning shell with unsanitized input (changelog indicates the author fixed earlier issues).