Clawshier

• Analyzed: May 15, 2026, 5:38 AM
• Findings: 1
• Version: 0.1.5
• Hash: 0741bece99061b91bddec5bd83fd2957181ed6aa71636ce8f82970bf696608e2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The clawshier skill is a well-architected receipt processing pipeline that extracts data from images using OCR (OpenAI or local Ollama) and logs it to Google Sheets. The code demonstrates security consciousness by using a dedicated pipeline runner (scripts/run_pipeline.js) and structured JSON I/O (lib/io.js) to prevent shell injection vulnerabilities when passing data between steps. It includes legitimate features like execution tracing (lib/trace.js), automated deduplication via SHA-256 fingerprinting (lib/hashing.js), and comprehensive unit tests, with no evidence of malicious intent or unauthorized data exfiltration.