Openclaw Receipt Manager

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:43 AM UTC
• Version: 0.1.7

Overview

This receipt skill coherently stores and searches receipt images and extracted receipt data locally, with no evidence of cloud upload, credential access, hidden persistence, or malicious behavior.

Install this only if you want receipt images and extracted receipt details retained locally on your machine. Review or clear the data/receipts folder if you do not want long-term storage, and be aware that broad expense-related triggers may invoke the skill in receipt-adjacent conversations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains broad everyday terms such as "expense," "花费," and "消费," which are likely to appear in normal conversations unrelated to receipt processing. This can cause unintended activation of the skill, leading to unexpected processing of chat images or receipt/archive actions without clear user intent.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger terms are very broad and include common words like 'receipt', 'expense', 'invoice', and 'spending', which can cause the skill to activate for ordinary conversations not clearly requesting receipt storage or analysis. In this skill’s context, unintended activation is more dangerous because the skill handles financial documents and may lead to automatic local persistence of sensitive receipt data without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill states that receipt data is 'saved automatically via handler' but does not prominently warn in the user-facing description or usage flow that both extracted data and images are persisted to local storage. This is dangerous because receipts often contain sensitive financial and personal information, and users may share images for analysis without realizing they are being retained.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["--text", text])

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            return {"ok": True, "message": f"✅ 已保存收据: {vendor} ${total} {currency}"}
        else:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The returned success string includes Chinese text ('已保存收据') even though the file does not offer any language selection or explain a locale-specific requirement. This creates a natural-language policy issue because the skill imposes a specific language on users without opt-in.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not tesseract:
        return None
    try:
        proc = subprocess.run(
            [tesseract, str(image), "stdout", "-l", "eng+chi_sim"],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: At L217 the code documents a security control for path traversal, but the actual logic resolves the path first at L215 and then checks for '..' in the resolved absolute path string at L218, which no longer reflects the original traversal syntax. The following home-directory restriction at L222-L223 is a different constraint, so the comment overstates what the code specifically does.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The NLP query feature only recognizes Chinese trigger patterns and returns Chinese-only example hints, which imposes a specific language on users. This is a natural-language policy issue because the file does not offer an explicit language choice or document a justified region-specific constraint.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The module docstring emphasizes database setup, ingestion, search, show, and summary usage examples, which suggests a management and ingestion utility with read/add workflows. However, the code also implements record mutation via update at L459-L498 and deletion of both DB rows and optionally image files at L501-L532, capabilities not reflected in the top-level documentation.

Static analysis

No suspicious patterns detected.