v1.0.0

InvoiceTW

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 1:44 PM.

Analysis

The skill is mostly a local receipt tracker, but its main lottery-checking feature appears to use simulated hard-coded winning numbers while presenting results as real invoice prize checks.

GuidanceReview carefully before installing. It may be useful as a local receipt tracker, but do not trust its winning-status output for real financial decisions unless the prize-number source is verified or replaced with an official API.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Human-Agent Trust Exploitation

SeverityMediumConfidenceHighStatusConcern

InvoiceTW.js

// 簡化的中獎號碼資料庫（實際應連接到財政部 API）
// 這裡用隨機生成模擬

The user-facing skill describes automatic invoice winning checks, but the code itself says the winning-number database is simulated instead of connected to the official Ministry of Finance source.

User impactThe agent may tell a user that an invoice won or did not win based on fake or stale data, which could lead to missed claims or false confidence.

RecommendationDo not rely on this skill for real prize status unless it is changed to use an official, current data source or clearly labels results as examples/simulation.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

發票明細：`~/openclaw_workspace/InvoiceTW/receipts.json`
中獎記錄：`~/openclaw_workspace/InvoiceTW/wins.json`
報表：`~/openclaw_workspace/InvoiceTW/reports/`

The skill persistently stores user-entered invoice details, winnings, and reports in local workspace files.

User impactInvoice numbers, stores, dates, amounts, categories, and notes may remain on disk and be visible to anyone or any process with access to the workspace.

RecommendationStore only information you are comfortable keeping locally, protect the workspace, and delete the files if you no longer want the records retained.