Financialclaw
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and runtime instructions are consistent with a local personal-finance plugin: it stores data in an embedded SQLite DB and modifies your OpenClaw config to enable itself; it does not request unrelated credentials or reach out to external endpoints.
This plugin appears coherent and implements the features it advertises. Before installing: (1) review the setup script (bin/financialclaw-setup.mjs) because it will read/write your OpenClaw config and add financialclaw to plugins.allow and tools.allow — back up your openclaw.json first or run setup with --config pointing to a copy; (2) the DB is stored by default at ~/.openclaw/workspace/financialclaw.db (can be overridden with the setup --db-path option or by the FINANCIALCLAW_DB_PATH env var); (3) the setup prompts for confirmation unless run with --yes; (4) there are no hidden network endpoints or secret requests in the code, but if you plan to send sensitive receipts over a channel, remember those images are handled by the agentic OCR flow (the plugin itself does not call external OCR providers). If you want extra assurance, inspect the repository files locally and run the setup interactively to see the exact changes before committing them.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal reported no malicious or suspicious engine hits. ClawHub promoted this source-linked package after clean LLM and clean static scans.
Risk analysis
No visible risk-analysis findings were reported for this release.