Accouting Skill For 财金记账
v1.0.0智能记账助手。用户提到记账、支出、收入、账本、流水、应收、应付、发票、票据、报销等关键词时使用此技能。支持文字直接记账，也可调用其他技能预处理图片/语音/文件后进行记账。
⭐ 1· 77·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description, required binary (python), and the single env var (ACCOUNTING_API_TOKEN) line up with an accounting integration. The included script implements CLI commands that map to ledger/transaction APIs; no unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md restricts behavior to detecting accounting info, calling preprocessing skills (ocr/stt/parse_file), querying metadata, and calling the bundled script to add/query entries. Important: the workflow explicitly states it will 'directly complete bookkeeping without asking the user for confirmation' when matching fields — this is a behavioral choice (not strictly a technical incoherence) but could lead to unexpected writes if mis-triggered.
Install Mechanism
No install spec; the skill is instruction-plus-a-script (no downloads). The script makes network calls to DEFAULT_BASE (https://api.caiwu888.cn). While the install surface is low-risk, the runtime network target is a third‑party endpoint not documented in the skill metadata (no homepage).
Credentials
Only ACCOUNTING_API_TOKEN is required and is declared as the primary credential — this is proportionate for an API-backed accounting integration. However, that token grants the skill authority to query and add financial records on the remote service, so the token must be trusted and scoped appropriately.
Persistence & Privilege
always:false and no modifications to other skills or system configs. The skill does not request persistent platform privileges beyond running autonomously when invoked.
Assessment
This skill appears to do what it says: it parses user text (or preprocessed OCR/STT/file outputs) and calls a remote accounting API using ACCOUNTING_API_TOKEN. Before installing: (1) only supply a token you trust and preferably one scoped/minimized for this service; (2) be aware the skill will automatically create transactions without asking for confirmation — consider whether you want that behavior; (3) the script contacts https://api.caiwu888.cn (no homepage listed in metadata) — verify the vendor/service reputation and privacy policy if you plan to send real financial data; (4) test with a throwaway/sandbox account first. If you want an extra safety step, require the agent to ask the user to confirm each new entry instead of auto-committing.Like a lobster shell, security has layers — review code before you run it.
latestvk97f9z519cz8amrg2qa8sy19g584755e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💰 Clawdis
Binspython
EnvACCOUNTING_API_TOKEN
Primary envACCOUNTING_API_TOKEN