Sync your AI coding stats to Code Card - beautiful, shareable developer profiles

This skill is internally consistent with its purpose, but a few practical cautions before you install/use it: - npx executes a package downloaded from npm each time; review the 'code-card' package page and repository (npm: https://www.npmjs.com/package/code-card, site: https://www.codecard.dev) to ensure it is the expected project and maintained by a trusted author. - The SKILL.md checks ~/.claude/.codecard for CC_API_KEY. Confirm you want your Code Card API key stored/read from that file and that it doesn't accidentally contain other secrets. - If you are security-conscious, instead of directly running npx from the agent, manually install the package locally (npm i -g code-card or inspect the package contents) and audit its code before running it. Running it in an isolated environment (container/VM) reduces risk. - The cron example uses a 'cron add' helper which may not exist on all systems; it is advisory. If you automate runs, prefer a method you control and verify (system cron, CI runner) and avoid embedding secrets in world-readable locations. If you want a deeper evaluation, provide the code/repo URL for the 'code-card' npm package or paste the CLI script contents so I can inspect what it does when it runs and how it handles your API key.

Type: OpenClaw Skill Name: code-card-sync Version: 2.0.0 The skill is designed to sync AI coding statistics to the Code Card service (codecard.dev). The instructions in SKILL.md use standard npx commands to run the 'code-card' package and suggest cron jobs for automation, which are consistent with the stated purpose. No evidence of malicious intent, unauthorized data exfiltration, or prompt injection was found.