nl2ledger

PassAudited by ClawScan on May 1, 2026.

Overview

This skill transparently turns confirmed expense descriptions into rows in a local QianJi CSV ledger, with no evidence of hidden network, credential, or destructive behavior.

Install only if you want the agent to help edit your local QianJi CSV. Before confirming any entry, check the selected CSV file, parsed amount, category, account, and note text.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the user confirms an incorrectly parsed amount, category, account, or file path, the local ledger could receive an inaccurate entry.

Why it was flagged

The skill instructs the agent to run a local append command that changes a financial ledger, but only after an explicit preview-and-confirm step.

Skill content

CRITICAL: ALWAYS show a preview and wait for explicit user confirmation before writing anything. ... For each confirmed entry, run the append script

Recommendation

Review the preview carefully, especially the amount, account, category, and target CSV file, and keep a backup of the ledger.