Family Bookkeeping

• Risk level: Low Risk
• Analyzed: Apr 16, 2026, 9:48 AM
• Findings: 0
• Version: 1.0.5

Overview

The skill's declared purpose (family bookkeeping with Feishu Bitable) matches the code and requested environment variables; nothing in the package appears to try to do unrelated or hidden network access or credential exfiltration.

This package appears to do what it says: normalize bill exports, deduplicate, optionally write rows to a Feishu Bitable, and produce reports. Before using it with production data: 1) Test it against a sandbox Feishu app/table to confirm behavior and mappings. 2) Keep your FEISHU_APP_SECRET and app tokens private — the scripts will use them to obtain tenant tokens and write/read records. 3) The pipeline writes files into working directories (e.g., family-import-<input-stem>) and reads user-provided bill files; review/backup any sensitive exports before processing. 4) The codebase has some small quality issues (e.g., an apparent duplicated/trailing lines in scripts/add_manual_record.py that may cause a runtime error); review or run in a controlled environment first. 5) If you rely on ~/.openclaw/workspace/.env as documented, ensure that file only contains expected variables (it may be used as a default config source).