LedgerAI
Security checks across static analysis, malware telemetry, and agentic risk
Overview
LedgerAI is a coherent bookkeeping API helper, but users should know it sends financial data and optional email/API-key credentials to an external provider.
This skill appears purpose-aligned and not malicious from the provided artifacts. Before using it, confirm you trust the LedgerAI/Voss Consulting Group API with invoices, receipts, expenses, and reports, and handle LEDGERAI_API_KEY or generated free keys as secrets.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Invoices, receipts, expenses, or report inputs you provide may be sent to the LedgerAI/Voss Consulting Group API.
The skill sends invoice or financial payloads to an external API endpoint. This is central to the bookkeeping purpose and is disclosed, but the data may be sensitive.
curl -X POST https://anton.vosscg.com/v1/invoices/process ... -d '{"url": "https://example.com/invoice.pdf", "action": "parse"}'Only send financial documents you are comfortable sharing with this provider, and review the provider’s privacy and retention terms before use.
Using the skill may associate your email and bookkeeping requests with a LedgerAI account or API key.
The skill uses an API key or email-based signup to access the provider service. This credential use is expected for the integration, but it is not declared in the registry metadata.
Set `LEDGERAI_API_KEY` or `LEDGERAI_EMAIL` for auto-signup (free, no credit card).
Use a dedicated API key where possible, avoid sharing it in chat or logs, and unset LEDGERAI_EMAIL after signup if you do not want repeated auto-signup behavior.
A generated LedgerAI API key could appear in terminal history, agent logs, or other captured output.
The helper prints a newly generated API key to stderr. This may be useful for setup, but API keys are credentials and can be exposed if command output is logged.
[ -n "$API_KEY" ] && echo "✅ Free key: $API_KEY" >&2
Treat printed API keys as secrets, rotate them if exposed, and avoid running the helper in environments where stderr is broadly logged.