CLI task timer for AI agents — benchmark learning progression with auto-save logs and visualizations. Integrates with ClawVault for persistent memory.
Security Analysis
medium confidenceThe skill's CLI functionality and local data storage match its description, but the advertised automatic sync to ClawVault (an external service) and lack of declared credentials, homepage, or source information are inconsistent and worth caution.
The skill name/description align with requiring a tasktime CLI binary and the npm package @versatly/tasktime. However, the description claims automatic integration with ClawVault (an external memory service) but there are no declared environment variables, config paths, or required binaries for authenticating or interacting with ClawVault—this is an unexplained gap.
SKILL.md only instructs use of the tasktime CLI and references a local data file (~/.tasktime/tasks.json), which is expected. It also states that completed tasks are 'Auto-save[d] to ClawVault' on stop, implying automatic transmission of user task data to an external service. The instructions neither document how authentication to ClawVault is obtained nor require or declare the clawvault binary; automatic external sync without describing credential or user consent is a scope concern.
Install is via npm: @versatly/tasktime producing binaries tasktime and tt. npm is a reasonable distribution channel for a CLI, but the skill metadata lacks a homepage or verifiable source repository, increasing uncertainty about the package contents and trustworthiness.
The skill declares no required environment variables or credentials, yet it performs automatic syncs to ClawVault (network exfiltration of task logs). If ClawVault requires authentication, those creds are not declared, which is inconsistent. There is a risk the CLI may read auth tokens from unexpected locations or rely on implicit agent credentials; the metadata should specify what secrets or config are needed.
The skill does not request always:true and only writes to its own path (~/.tasktime/tasks.json), which is reasonable for a CLI timer. The primary privilege concern is the automatic external sync behavior rather than local persistence; the skill does not claim to modify other skills or global agent settings.
Guidance
Before installing: (1) Verify the npm package source (check the package page, repository, and publisher) rather than installing blindly. (2) Inspect the package contents (or install in an isolated container/VM) to confirm what it does, especially network calls. (3) Confirm how ClawVault auth is handled — if you don't want external uploads, use tasktime stop --no-vault or avoid enabling sync. (4) Review ~/.tasktime/tasks.json for sensitive content and consider filesystem permissions. (5) Prefer non-global or sandboxed installation while evaluating. If you need help reviewing the package files or determining what auth the CLI uses, gather the package tarball or repository link and consult someone who can inspect it.
Latest Release
v1.2.0
Auto-save to ClawVault on stop (🐘 emoji confirms). Use --no-vault to skip.
More by @G9Pedro
Published by @G9Pedro on ClawHub
