Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Copilot Money Mac
v1.0.0Query and analyze personal finance data from the Copilot Money Mac app. Use when the user asks about their spending, transactions, account balances, budgets,...
⭐ 0· 600·0 current·0 all-time
byCharlie DiGiovanna@chardigio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the runtime instructions: the SKILL.md explicitly targets the Copilot Money SQLite DB and Firestore LevelDB cache in macOS app containers and provides SQL and shell commands to read that data. The requested access (local DB files) is proportional to the stated functionality.
Instruction Scope
Instructions tell the agent to read sensitive local files (~/Library/Group Containers/... and ~/Library/Containers/...), use sqlite3 and strings to extract data, and run SQL queries. This is necessary for the task, but the skill contains no guidance on limiting or redacting sensitive output and assumes queries are read-only; users should treat any execution that reads financial data as highly sensitive.
Install Mechanism
Instruction-only skill with no install spec or external downloads. Nothing is written to disk by the skill itself and no third-party packages are pulled in.
Credentials
The skill requests no environment variables, credentials, or config paths beyond the local app data paths it documents. Those paths are directly relevant to the stated purpose.
Persistence & Privilege
always: false and no special privileges requested. The skill does not request permanent presence or attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by platform default but is not granted here with any extra privileges.
Assessment
This skill is coherent: it documents where Copilot Money stores local data and how to query it with sqlite3 and strings. However, the files it reads contain highly sensitive personal financial information. Before installing or using it: 1) Only install if you trust the skill source (this package has no homepage and an unknown owner). 2) Prefer user-invoked use (don’t permit unattended/autonomous runs), and review any queries before they run. 3) Be aware the SKILL.md assumes read-only access but doesn't enforce it—avoid running write/update SQL. 4) If you’re uncomfortable giving an agent automated access to local finance files, run the shown sqlite3/strings commands yourself in a terminal instead of granting agent access. 5) Verify the Copilot Money app paths match your system and back up the DB before experimenting. If you want stronger assurance, request a signed/published skill from a known publisher or ask the maintainer to include explicit data-handling and privacy constraints.Like a lobster shell, security has layers — review code before you run it.
latestvk975p20n6dek9s5m26ncse705581atfs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.