momo

PassAudited by ClawScan on May 1, 2026.

Overview

This skill looks like a harmless local shell-script stub, but its documentation overstates the time-tracking and invoicing features actually present.

This appears safe from the reviewed artifacts, but it is mostly a stub. Do not rely on it to preserve timesheets, generate invoices, or track payment status unless you verify the actual output and storage behavior.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

When invoked, the agent may run a local shell script, but the reviewed implementation does not show harmful or broad system actions.

Why it was flagged

The skill is allowed to execute its included shell script. This is expected for the documented CLI workflow, and the provided script is limited to printing mode messages.

Skill content
"permissions": ["exec"],
  "entry": "SKILL.md",
  "scripts": ["scripts/timesheet.sh"]
Recommendation

Treat this as a local command helper and review any future script changes before relying on automatic invocation.

What this means

A user or agent might think invoices, PDFs, or payment statuses were created or tracked when this version does not show that functionality.

Why it was flagged

The documentation promises invoice formats and status tracking, but the included implementation only echoes log/report/invoice modes, so users should not assume those financial workflow features actually exist.

Skill content
Convert logged time to invoices with one command. Momo supports multiple formats (PDF, Markdown) and tracks invoice status (draft, sent, paid).
Recommendation

Verify actual records and invoice outputs before using this skill for business billing or payment tracking.