Smart Expense Tracker

• Analyzed: May 11, 2026, 5:03 AM
• Findings: 1
• Version: 1.1.0
• Hash: 8e696b03922c72ad9e6ebe4a5420698446c409fd9e854a983bbada83c9d17c67
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle 'zhichu-tracker' is classified as benign. All files (SKILL.md, scripts/expense-tracker.py, scripts/report-generator.py, assets/categories.json) align with the stated purpose of a local expense tracker. The Python scripts handle local JSON data storage with appropriate file permissions (0o600 for data files, 0o700 for data directory) and atomic write operations, demonstrating good security practices for local data. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent in SKILL.md. The natural language parsing in the scripts is solely for extracting financial data, not for executing commands.