Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent accounting statement skill with disclosed local data use, draft controls, and review gates, though users should be careful with sudo setup and emailing financial reports.
Install jq through a trusted package-management process, point OPENCLAW_DATA_DIR only at the intended accounting data, and treat generated reports as sensitive drafts until reviewed by a qualified accountant. Before sending statements to clients, confirm approval, recipient identity, and secure delivery requirements.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
No external credentials required. Generates financial statements (P&L, balance sheet, cash flow) from data in OPENCLAW_DATA_DIR. Includes a completeness gate that blocks generation if source data is incomplete.
Line L092 specifies that the output 'is in English suitable for an accounting assistant to act on' as a hard requirement. This is a natural-language locale constraint, and the file does not indicate that the user is given a language choice or that English-only output is required for a justified region-specific compliance reason.
The setup instructions tell the user to run 'sudo apt install jq', which normalizes privilege escalation as part of using the skill. In an adversarial or automated-agent setting, encouraging root-level package installation can lead to unintended system modification and expands the blast radius if the instruction is followed on production or sensitive hosts.
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
No external credentials required. Generates financial statements (P&L, balance sheet, cash flow) from data in OPENCLAW_DATA_DIR. Includes a completeness gate that blocks generation if source data is incomplete.
The skill explicitly includes a workflow to send financial statement packs to clients via email, but it does not require any warning, approval gate, or secure transmission guidance for highly sensitive financial data. In a finance/accounting context, this increases the risk of inadvertent external disclosure, misdelivery, or transmission over insecure channels.