Wave

Wave accounting — invoices, customers, transactions, accounts, products, taxes. Small business accounting CLI.

Security Scan

The skill's code and runtime instructions are coherent with a Wave accounting CLI: it only needs a Wave API token, talks to Wave's GraphQL endpoint, and does not install external artifacts or request unrelated credentials.

Purpose & Capability

Name/description (Wave accounting CLI) match the code and SKILL.md. The script uses WAVE_API_TOKEN to call Wave's GraphQL API (https://gql.waveapps.com/graphql/public) and implements invoice, customer, transactions, accounts, products, and taxes operations — all consistent with the stated purpose.

Instruction Scope

SKILL.md instructs running the bundled Python script and declares only WAVE_API_TOKEN. The script's runtime behavior stays within that scope: it only reads the token, constructs GraphQL queries/mutations, and sends them to the Wave API. There are no instructions to read or transmit unrelated system data.

Install Mechanism

No external install/download steps. The skill is instruction + a single Python stdlib-only script included in the bundle, so nothing is fetched from external URLs or written to surprising locations during install.

Credentials

The only declared credential is WAVE_API_TOKEN, which is appropriate. The script will also look for a .env file under WORKSPACE or ~/.openclaw/workspace to source WAVE_API_TOKEN if not in the environment; it only parses that file for a WAVE_API_TOKEN= line. This is reasonable but means the script accesses a workspace .env file if present — review that file for other secrets and ensure the token has least privilege.

Persistence & Privilege

always is false and the skill does not modify other skills or system-wide settings. It does not request permanent agent presence beyond normal (autonomous invocation is allowed by default but not elevated by this skill).

Assessment

This skill appears to do what it says: it needs only a Wave API token and calls Wave's public GraphQL endpoint to manage invoices, customers, transactions, etc. Before installing: (1) confirm you trust the skill author (homepage is agxntsix.ai, not an official Wave domain), (2) store a token with minimal permissions and avoid using a highly-privileged account, (3) check your ~./openclaw/workspace/.env or WORKSPACE .env for other secrets (the script will read that file to extract WAVE_API_TOKEN), and (4) test the skill in a non-production environment first. If you need stricter assurance, ask the maintainer for the exact token scopes/permissions required or review the script locally before providing the token.

Invoicing and accounting for small business — invoices, customers, transactions.

Features

• Businesses — list connected businesses
• Invoices — create, send, list, delete
• Customers — manage customer records
• Accounts — chart of accounts
• Transactions — view financial transactions
• Products & taxes — manage items and tax rates

Requirements

Variable	Required	Description
WAVE_API_TOKEN	✅	API key/token for Wave

Quick Start

python3 {baseDir}/scripts/wave.py businesses
python3 {baseDir}/scripts/wave.py invoices <business-id>
python3 {baseDir}/scripts/wave.py invoice-create <business-id> <customer-id> --amount 500
python3 {baseDir}/scripts/wave.py customers <business-id>
python3 {baseDir}/scripts/wave.py transactions <business-id>

Credits

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation