Skills installing-skill-tracker
📦

installing-skill-tracker

Content revision r2 High Risk ⚙️ External commands📁 Filesystem access

Install Claude Code Skill Tracking

Teams cannot measure which Claude Code skills run or whether procedural skills succeed. This installer adds local hooks, activity logs, verification, and usage analysis.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "installing-skill-tracker" from https://skillstore.io/skills/asmayaseen-installing-skill-tracker.md and its manifest at https://skillstore.io/api/skills/asmayaseen-installing-skill-tracker/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-installing-skill-tracker.md Signed manifest GET /api/skills/asmayaseen-installing-skill-tracker/manifest Signed lockfile GET /api/skills/asmayaseen-installing-skill-tracker/lockfile

Test it

Using "installing-skill-tracker". Check whether tracking is installed without changing the project.

Expected outcome:

Tracking is incomplete. The hook directory exists, but jq and the prompt hook registration are missing. No files were changed.

Using "installing-skill-tracker". Summarize current skill usage.

Expected outcome:

The analysis found 24 skill invocations. Procedural skills passed 18 of 20 verifications, and two installed skills had no recorded usage.

Using "installing-skill-tracker". Install tracking and report the result.

Expected outcome:

Tracking hooks were added and verified. Project settings changed, executable hook scripts were created, and local prompt logging is now active.

Security Audit

High Risk
v9 • 7/23/2026 Open versioned report

Most static alerts are false positives from shell syntax embedded in Python strings, Markdown fences, and ordinary JSON processing. The settings write is intentional but changes project configuration. The generated prompt hook stores complete prompts and session identifiers locally without redaction, access controls, consent, or retention limits.

3
Files scanned
586
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

High
scripts/setup.py:24-36
Unredacted Prompt and Session Logging
The generated prompt hook stores every submitted prompt with its session identifier in a local plaintext JSONL file. Prompts can contain credentials, private code, or personal data.
The generated hook directly extracts the complete prompt and session identifier, then appends both values to prompts.jsonl without redaction or permission controls.
Medium
scripts/setup.py:275-310scripts/setup.py:339-374
Persistent Broad Hook Registration
Setup registers commands for all prompt submissions and selected Bash and Read events. Installation provides no consent prompt, preview, backup, or uninstall mechanism.
The hook configuration and settings merge clearly establish persistent event handlers, while the setup flow writes changes immediately without confirmation or rollback.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
scripts/setup.py:372
Python file write/append
with open(SETTINGS_FILE, "w") as f:
The installer intentionally rewrites .claude/settings.json after merging persistent hook commands. A failure or unexpected working directory can alter project configuration.

Risk Factors

⚙️ External commands (29)
scripts/setup.py:21 scripts/setup.py:24 scripts/setup.py:25 scripts/setup.py:26 scripts/setup.py:47 scripts/setup.py:50 scripts/setup.py:51 scripts/setup.py:69 scripts/setup.py:70 scripts/setup.py:88 scripts/setup.py:91 scripts/setup.py:92 scripts/setup.py:110 scripts/setup.py:111 SKILL.md:11-14 SKILL.md:14-19 SKILL.md:19-21 SKILL.md:21-24 SKILL.md:24-26 SKILL.md:26-29 SKILL.md:29-31 SKILL.md:31-36 SKILL.md:36-38 SKILL.md:38-41 SKILL.md:41-43 SKILL.md:43-46 SKILL.md:46-48 SKILL.md:48-51 SKILL.md:51-53
📁 Filesystem access (1)
scripts/setup.py:372
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/asmayaseen-installing-skill-tracker/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-installing-skill-tracker/security.svg)](https://skillstore.io/skills/asmayaseen-installing-skill-tracker?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-installing-skill-tracker?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-installing-skill-tracker/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-installing-skill-tracker.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). installing-skill-tracker security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-installing-skill-tracker/audits/9

BibTeX citation

@techreport{asmayaseen-asmayaseen-installing-skill-tracker-2026, author = {Asmayaseen}, title = {installing-skill-tracker security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/asmayaseen-installing-skill-tracker/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "installing-skill-tracker security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "Asmayaseen" date-released: "2026-07-23" url: "https://skillstore.io/skills/asmayaseen-installing-skill-tracker/audits/9" identifiers: - type: other value: "skillstore:asmayaseen-installing-skill-tracker:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Measure Team Skill Adoption

Install local tracking to compare skill invocations and identify skills that remain unused.

Monitor Procedural Reliability

Review verification outcomes and failure rates for skills that include validation scripts.

Validate Hook Installation

Check required files, permissions, dependencies, and hook settings after project setup.

Try These Prompts

Check Before Installation 
Check whether skill tracking hooks are already installed in this project. Report missing dependencies and do not change files.
Install Local Tracking 
Install the skill tracker in this project, verify every component, and summarize all files and settings changed.
Analyze Skill Usage 
Run the local skill usage analysis and summarize invocations, verification success rates, failures, and unused skills.
Plan a Privacy-Aware Rollout 
Review the tracker before installation. Propose prompt redaction, restricted log permissions, retention limits, rollback, and narrower hook matchers.

Best Practices

  • Review settings changes and back up existing hook configuration before installation.
  • Restrict activity-log permissions and remove sensitive prompts according to a defined retention policy.
  • Run verification after setup and after every change to project hook settings.

Avoid

  • Do not install tracking in repositories that prohibit recording prompts or session identifiers.
  • Do not run setup from an unverified working directory because paths are based on the current directory.
  • Do not treat invocation counts as proof that a skill produced correct or valuable results.

Frequently Asked Questions

What does this skill install?
It creates three Bash hooks, one Python analyzer, activity-log directories, and matching Claude Code settings entries.
Does it send data to external services?
No network transmission appears in the reviewed files. The generated hooks store activity in local project files.
What information is recorded?
It records complete prompts, session identifiers, skill names, event types, timestamps, and procedural verification status.
Which dependencies are required?
The installer and verifier require Python. Generated hooks also require Bash and jq.
Can I remove the tracker automatically?
No uninstall workflow is included. Remove hook entries and generated files only after reviewing existing project settings.
Does it support Codex tracking?
The reviewed implementation configures Claude Code hooks. It does not include a native Codex event integration.

Developer Details

Author

Asmayaseen

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/Asmayaseen/hackathon-2/tree/main/.claude/skills/installing-skill-tracker

Ref

89edfdc710d0846129dcee6a929477b04f08052c

Maintenance freshness

7/24/2026

Usage

2 downloads · 196 views

File structure

📁 scripts/

📄 setup.py

📄 verify.py

📄 SKILL.md