Receipt Snap
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, install, and runtime instructions are consistent with its stated purpose (processing receipts, converting currency, uploading to Google Drive, and logging to Google Sheets); no disproportionate or unrelated permissions or suspicious network endpoints were found, though there is a minor metadata inconsistency to be aware of.
This skill appears to do what it says: it calls the gog CLI to upload files to Google Drive and append rows to Google Sheets, and it fetches exchange rates from open.er-api.com. Before installing, confirm: 1) you trust the Homebrew formula (faradayhq/gog/gog) and run 'gog auth login' yourself so OAuth tokens stay under your control; 2) set RECEIPT_DRIVE_FOLDER_ID and RECEIPT_GOOGLE_SHEET_ID (and optionally RECEIPT_LOG_FILE) — the top-level registry metadata omitted these even though the skill requires them; 3) review and secure the local log file path (it contains financial data) and add it to .gitignore if storing in a repo; 4) if you want additional assurance, inspect receipt_snap.py locally (it uses subprocess to call gog and urllib to fetch exchange rates) before use. If any of these steps or the brew formula look unfamiliar, investigate the gog package source and verify the Drive/Sheet IDs before using the skill with real receipts.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.