Personal Expense Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local expense tracker, with the main thing to notice being that it saves expense records and monthly summaries on disk.

This appears safe for a local personal tracker. Before installing, be aware that your expense entries and monthly summaries are saved as local JSON files; do not enter highly sensitive details unless you are comfortable storing them on this device.

VirusTotal

No VirusTotal findings

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI06: Memory and Context Poisoning
Low
What this means

Expense notes, amounts, categories, and monthly totals can remain on the local machine after use and may be visible to anyone or anything else with file access.

Why it was flagged

The skill stores personal expense records in a persistent home-directory JSON file and also saves monthly summary data to a local sample.json file when stats are generated.

Skill content
DATA_DIR = Path.home() / ".expense-tracker" ... DATA_FILE = DATA_DIR / "expenses.json" ... sample_file = Path(__file__).parent.parent / "data" / "sample.json"
Recommendation

Use non-sensitive notes if privacy matters, and periodically review or delete ~/.expense-tracker/expenses.json and the local data/sample.json file if you no longer want the records kept.