Kiwi Receipts
v2.0.1NZ tax assistant for sole traders. Process receipt photos into IRD-ready GST reports, track sales income for GST Box 5, calculate IR3 annual income tax, prov...
⭐ 0· 116·0 current·0 all-time
byLiu Jie@maxazure
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (GST, IR3, depreciation, Xero export) align with included files (SKILL.md, generate_report.py, NZ tax references). The skill only needs local file I/O, receipt extraction, and XLSX/CSV generation — which is consistent with what it asks for. No unrelated cloud credentials, system config paths, or binaries are requested.
Instruction Scope
Runtime instructions confine operations to: (1) analysing images provided in context with the agent's vision/model, (2) confirming extracted data with the user, and (3) reading/writing JSON files under ~/.openclaw/data/kiwi-receipts and invoking the bundled Python report generator. There are no instructions to read unrelated system files, harvest environment variables, or post data to external endpoints. The skill explicitly says it does not upload data.
Install Mechanism
There is no automatic install spec (instruction-only). The repo/README suggests optional install via ClawHub or git clone and a Python dependency (openpyxl). This is proportional, but the user must manually pip-install openpyxl before report export. No downloads from untrusted URLs or archive extraction are present in the package.
Credentials
The skill declares no required environment variables, no primary credential, and no special config paths beyond its own data directory. That is proportionate to its purpose.
Persistence & Privilege
always is false (default) and the skill stores data only under its own data directory. It does not request persistent platform-wide privileges or modify other skills' configs. Autonomous invocation remains possible (platform default) but is not combined with broad credentials or elevated privileges.
Assessment
This skill appears internally consistent and limited to local processing, but review these before installing:
- openpyxl dependency: report generation will fail unless you install openpyxl (pip). The skill doesn't auto-install Python packages.
- Vision/model handling: the SKILL.md assumes your OpenClaw vision/model will do OCR. If your configured model provider is cloud-hosted (or the agent is set to call a third‑party API), receipt images could be sent off-device — confirm how your OpenClaw instance performs image processing if you need receipts to remain fully local.
- Data sensitivity & storage location: all tax data (GST/IRD numbers, receipts, income records) is kept under ~/.openclaw/data/kiwi-receipts/. Back up and secure that directory (file permissions, disk encryption). The skill claims IRD record-keeping rules (e.g., keeping records in NZ) but does not enforce storage location — ensure your environment meets any legal/regulatory requirements.
- Installation sources: README suggests installing via ClawHub or git clone from GitHub. Only use sources you trust and verify the repository content before copying into your skills directory.
- Verify results: this tool aids record-keeping and auto-calculates tax figures. Always double-check numbers and consult an accountant before filing with IRD.
If you want, I can (a) highlight any lines in the included Python script that warrant extra review, (b) check the SKILL.md for any truncated/incomplete instructions, or (c) produce a short checklist to harden the local storage and model configuration.Like a lobster shell, security has layers — review code before you run it.
latestvk97c3hsdxeqxeq5sf76jpxn8gs837ev2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧾 Clawdis