Beancount
Security checks across malware telemetry and agentic risk
Overview
This appears to be a local bookkeeping skill; the main thing to notice is that it stores personal finance data persistently on disk.
Before installing, be comfortable with local storage of your financial records in `~/.bookkeeping/`. The documented behavior is purpose-aligned and local-only, but protect the files like other personal finance data and use the documented `scripts/book.sh` workflow unless you have reviewed the auxiliary script.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your income, spending, budget, and savings-goal data will remain on the computer and may be reused in later reports or lists.
The skill persistently stores user-entered financial records, budgets, and goals in local files, which is purpose-aligned but sensitive.
记录文件: `~/.bookkeeping/records.json` - 预算文件: `~/.bookkeeping/budgets.json` - 目标文件: `~/.bookkeeping/goals.json` - 自动创建目录和文件
Use it on a trusted machine, avoid putting secrets in transaction notes, and review or delete `~/.bookkeeping/` if you no longer want the data retained.
If that auxiliary script is used, some bookkeeping-related input or command history may be stored outside the documented `~/.bookkeeping/` directory.
An included auxiliary script uses a separate local data path and writes a command history log; this is local and not exfiltrating, but it is less clearly documented than the main `scripts/book.sh` workflow.
DATA_DIR="${BEANCOUNT_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/beancount}"
DB="$DATA_DIR/data.log"
...
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Prefer the documented `scripts/book.sh` commands, and inspect or remove `~/.local/share/beancount/` if you invoke `scripts/script.sh` and do not want its extra local history.