QuickBooks

ReviewAudited by ClawScan on May 6, 2026.

Overview

This is a coherent QuickBooks integration, but it involves ClawLink-managed OAuth access and potentially high-impact financial changes that users should review carefully.

This skill appears purpose-aligned for QuickBooks finance work. Before installing, make sure you trust ClawLink, review the QuickBooks OAuth permissions, never paste raw credentials into chat, and only approve financial writes after checking the preview carefully.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If approved, the agent may change QuickBooks financial or customer data.

Why it was flagged

The skill can use ClawLink tools to perform QuickBooks write actions, which may affect financial or customer records. The artifact includes preview and confirmation safeguards, making this a purpose-aligned note rather than a concern.

Skill content
For writes or anything marked as requiring confirmation, call `clawlink_preview_tool` first, then confirm with the user. Execute with `clawlink_call_tool`.
Recommendation

Review every preview carefully before confirming writes, especially payments, account changes, bulk edits, or destructive operations.

What this means

ClawLink and the local OpenClaw plugin will hold credentials that can access the connected QuickBooks account according to granted scopes.

Why it was flagged

The skill uses delegated ClawLink and QuickBooks access. This is expected for a QuickBooks integration, but it gives the connected service authority over sensitive finance workflows.

Skill content
The resulting device credential is stored locally in OpenClaw's plugin config and is only sent to `claw-link.dev`.
Recommendation

Only connect accounts you intend to use with this skill, review the OAuth permissions during setup, and revoke access from ClawLink or QuickBooks when no longer needed.

What this means

Runtime behavior depends on the installed ClawLink plugin and live ClawLink tool catalog, not just this SKILL.md file.

Why it was flagged

The skill itself is instruction-only and depends on a separate ClawLink plugin for execution. Installing that plugin is purpose-aligned and user-directed, but the plugin code is not included in this artifact set.

Skill content
Install the verified ClawLink plugin: `openclaw plugins install clawhub:clawlink-plugin`
Recommendation

Install the plugin only from the expected ClawHub source and review ClawLink verification or source materials if your QuickBooks data is sensitive.

What this means

QuickBooks connection metadata, tool requests, and potentially finance-related data may pass through ClawLink as part of normal operation.

Why it was flagged

QuickBooks credentials and integration requests are mediated by the external ClawLink service. This is disclosed and central to the design, but it creates a third-party data boundary.

Skill content
ClawLink ... handles hosted connection flows and credentials so you don't need to configure QuickBooks API access yourself.
Recommendation

Use this only if you trust ClawLink with QuickBooks integration access, and check ClawLink's security, privacy, and revocation controls.