daily-viz
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to be a straightforward local habit and life tracker, with the main thing to notice being persistent personal-data storage and a minor package entry-point ambiguity.
This looks reasonable for local habit tracking. Before installing, be comfortable with personal records being saved locally, likely unencrypted in the included implementation, and verify how the package is invoked if commands do not work. There is no artifact evidence of credential use, network upload, background persistence, or destructive actions.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your mood, sleep, exercise, work, and similar entries may remain on disk across sessions and can be used in later reports.
The skill intentionally persists personal daily tracking data in a local JSON store so it can be reused for later visualization and analysis.
Record mood, exercise, sleep, work hours ... 所有数据保存在 `~/.daily-viz/data/` 目录，支持：- 本地 JSON 存储
Install only if you are comfortable storing this personal data locally; avoid entering secrets and delete or back up ~/.daily-viz/data/records.json as needed.
The skill may depend on platform-specific command mapping or may not run through the package main entry point as expected.
The package entry point named here is not present in the supplied file manifest, while the included executable helpers are in scripts/. This creates invocation/provenance ambiguity but does not show malicious behavior.
"main": "index.js"
Prefer a release that declares the actual entry point and required runtime clearly, or inspect the included scripts before relying on it.