Currency
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: currency Version: 2.0.0 The 'Currency' skill is a simple command-line travel planning and logging tool. The provided shell script (scripts/script.sh) manages text-based logs in a local directory (~/.local/share/currency) and includes basic functions for searching, viewing statistics, and exporting data to JSON, CSV, or TXT formats. While the SKILL.md documentation contains some poorly formatted table entries that appear to be copy-pasted script outputs (including harmless shell commands like 'du' and 'wc'), there is no evidence of malicious intent, data exfiltration, or unauthorized command execution.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Travel plans, budgets, booking notes, searches, and journal-style entries may remain saved on the device and could be viewed later by anyone with access to that account or directory.
The script stores user-entered activity in persistent local log files, creating a reusable history of travel/currency-related entries.
DATA_DIR="${HOME}/.local/share/currency" ... _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }Avoid entering passwords, payment details, or other secrets; periodically review or delete `~/.local/share/currency/` if you no longer want the history retained.
A user may need to manually decide how to install or run the included script, which increases the importance of verifying the script source and path before use.
The skill documentation assumes a `currency` CLI command and the manifest includes a shell script, but the artifact set does not define how that command is installed or made available.
No install spec — this is an instruction-only skill.
Only install or symlink the script after reviewing it, and prefer a clear, trusted installation method before adding it to your shell PATH.