Expense Tracker

• Analyzed: May 12, 2026, 4:12 AM
• Findings: 1
• Version: 1.1.0
• Hash: ebc7f17e065fbb197b272ec680df44088625eb3ca28af4fc60383fbe24e10eeb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/log_expense.py` skill is classified as suspicious due to two main reasons: 1) It explicitly writes backup files to `~/Documents/expenses_backup/`, which is outside the default OpenClaw workspace. While documented as a benign backup feature in `SKILL.md`, it represents an external file write capability. 2) The script accepts a `--workspace` argument that allows specifying an arbitrary path for storing expense files. If this argument were controlled by a malicious actor or a prompt-injected agent, it could lead to arbitrary file writes, posing a significant vulnerability (e.g., writing to sensitive system locations). There is no clear evidence of intentional malicious behavior, but these capabilities present a risk of abuse.