Receipt Snap
v1.0.6Process receipt photos and PDFs, extract vendor date amount currency, convert to EUR, upload to Google Drive with proper naming Vendor_Date_EURAmount.pdf, an...
⭐ 0· 79·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's claimed purpose (receipt extraction, currency conversion, Drive upload, Sheets logging) aligns with the required binary (gog), the provided code, and the SKILL.md instructions. Minor inconsistency: the registry summary at the top lists no required environment variables, but SKILL.md and the script clearly require RECEIPT_DRIVE_FOLDER_ID and RECEIPT_GOOGLE_SHEET_ID (and optionally RECEIPT_LOG_FILE). This appears to be a packaging/metadata omission rather than malicious misdirection.
Instruction Scope
SKILL.md instructs only to install gog, authenticate it, set the Drive/Sheet IDs, fetch exchange rates from open.er-api.com, check the sheet for duplicates, upload files via gog, and append rows to Sheets. The runtime instructions and code do not request unrelated system files or external endpoints beyond the exchange-rate API and Google via gog.
Install Mechanism
Installation uses a Homebrew formula (faradayhq/gog/gog) to provide the gog CLI. This is a normal package installation method; no arbitrary URL downloads or extraction steps are present in the spec.
Credentials
Environment variables required by the script (Drive folder ID, Sheet ID, optional local log path) are appropriate and proportional to the functionality. Note the manifest/registry summary omitted these env vars—verify the skill will prompt you to set them (SKILL.md does). The skill relies on gog-managed OAuth tokens rather than asking for raw credentials, which is appropriate.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not demand elevated system privileges. It writes a local CSV log (configurable via RECEIPT_LOG_FILE) and uses gog to store items in the user's Google Drive/Sheets as expected.
Assessment
This skill appears to do what it says: it calls the gog CLI to upload files to Google Drive and append rows to Google Sheets, and it fetches exchange rates from open.er-api.com. Before installing, confirm: 1) you trust the Homebrew formula (faradayhq/gog/gog) and run 'gog auth login' yourself so OAuth tokens stay under your control; 2) set RECEIPT_DRIVE_FOLDER_ID and RECEIPT_GOOGLE_SHEET_ID (and optionally RECEIPT_LOG_FILE) — the top-level registry metadata omitted these even though the skill requires them; 3) review and secure the local log file path (it contains financial data) and add it to .gitignore if storing in a repo; 4) if you want additional assurance, inspect receipt_snap.py locally (it uses subprocess to call gog and urllib to fetch exchange rates) before use. If any of these steps or the brew formula look unfamiliar, investigate the gog package source and verify the Drive/Sheet IDs before using the skill with real receipts.Like a lobster shell, security has layers — review code before you run it.
latestvk976vr1rrn60kg13t6bsrqbx3s83xx7z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
� 영수증 Clawdis
OSmacOS · Linux
Binsgog
Install
Install gog CLI via Homebrew
Bins: gog
brew install faradayhq/gog/gog