Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

BudgetRcd

v1.5.0

个人记账预算管理(支持工作日/周末差异预算 + 动态预算更新机制)。Budget tracking & planning (weekday/weekend differentiated + dynamic budget carry-forward). 记账/设置预算/查余额/存钱目标。Record expense...

0· 167·0 current·0 all-time
byKazuya@kazuya-ecnu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kazuya-ecnu/budgetrcd.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "BudgetRcd" (kazuya-ecnu/budgetrcd) from ClawHub.
Skill page: https://clawhub.ai/kazuya-ecnu/budgetrcd
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install budgetrcd

ClawHub CLI

Package manager switcher

npx clawhub@latest install budgetrcd
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the included modules (config_manager, expense_manager, calculator). The code implements local budgeting, expense CRUD, image copy, and dynamic budget calc — all coherent with the stated purpose.
!
Instruction Scope
SKILL.md mandates reading a personal config at ~/.openclaw/workspace/skills/budgetRcd/budgetRcd.config.json and strictly operating only inside the configured paths.root. The code, however, hardcodes DATA_DIR = ~/Documents/02_Personal/01_Budget and reads/writes under that path (CONFIG_DIR / DATA_DIR/data etc.). This mismatch means the agent's explicit instructions about where to read config and where file I/O should be limited are not enforced by the code. Additionally SKILL.md states amounts are stored as negative for expenses, but the code treats amounts as provided (docstrings and implementation expect positive numbers), creating another behavioral inconsistency.
Install Mechanism
No install spec is included (instruction-only install). There are code files bundled but no remote downloads or install steps, so nothing is pulled from external URLs at install time.
Credentials
The skill requests no environment variables or external credentials (proportionate). However it performs local filesystem reads/writes under a hardcoded user Documents path (~ /Documents/02_Personal/01_Budget) and will copy arbitrary files (images) into that directory if given paths. Users should be aware the skill will create and modify files under that directory.
Persistence & Privilege
The skill does not request permanent inclusion (always:false) and does not modify other skills or global agent settings. Write operations (add_expense, add_expenses_from_list, copy image) are implemented as fully-autonomous functions that do not require confirmation in code — this is expected by author notes but is operationally important for users to know.
What to consider before installing
This skill appears to implement a local budgeting tool, but there are important mismatches you should address before using it with real data: - Config path mismatch: SKILL.md tells the agent to read ~/.openclaw/workspace/skills/budgetRcd/budgetRcd.config.json and to restrict operations to paths.root, but the code ignores that and always uses ~/Documents/02_Personal/01_Budget. Confirm which config the agent will actually load. If you expect the skill to respect a workspace config, either modify the code to load that path or place the correct config at the hardcoded Documents location. - Amount sign mismatch: SKILL.md says expense amounts are stored as negative values, but the code treats amounts as provided (and sums amounts directly). That can cause wrong totals or confusing displays. Decide on a single convention and fix either the docs or the code. - File writes and image copying: The skill will create and modify files and copy any provided image path into the images directory under the hardcoded DATA_DIR. Only give it file paths you trust and consider backing up existing budget directories before first use. - Autonomous writes: add_expense and batch add functions have "full permission" (no confirmation) in code. If you do not want the agent to add records without explicit user confirmation, require confirmations before invoking these functions or change the code to prompt. If you are comfortable editing the skill, update config_manager/expense_manager to read the config path you prefer and to enforce the paths.root restriction. If not, test the skill in a sandbox or with a disposable folder to confirm behavior before putting real finance data under its control.

Like a lobster shell, security has layers — review code before you run it.

latestvk973f3qq89ajpng0b651p5ydnx84qt50
167downloads
0stars
9versions
Updated 2w ago
v1.5.0
MIT-0

budgetRcd v1.4 - 个人记账预算管理 / Budget Tracking & Planning


⚠️ 执行前必读 / MANDATORY BEFORE ANY OPERATION

每次执行skill时,必须先读取个人配置:

~/.openclaw/workspace/skills/budgetRcd/budgetRcd.config.json

所有文件操作只能在个人配置的 paths.root 目录下进行! 禁止使用任何硬编码路径或其他位置!


个人配置 / Personal Config

配置文件:~/.openclaw/workspace/skills/budgetRcd/budgetRcd.config.json

{
  "paths": {
    "root": "~/Documents/02_Personal/01_Budget",
    "data": "~/Documents/02_Personal/01_Budget/data",
    "config": "~/Documents/02_Personal/01_Budget/config",
    "images": "~/Documents/02_Personal/01_Budget/images"
  },
  "budget_rules": {
    "weekday": 100,
    "weekend": 200
  },
  "pools": { ... },
  "dynamic_budget": { "enabled": true },
  "pool_name_to_id": { ... }
}

预算规则 / Budget Rules

  • 工作日(周一~五)/ Weekdays (Mon–Fri):100 元/天
  • 周末(周六/日)/ Weekends (Sat–Sun):200 元/天

文件结构 / File Structure

所有路径基于 config 中的 paths.root

~/Documents/02_Personal/01_Budget/
├── config/
│   └── pools.json          # 预算池配置
├── data/
│   ├── budget_YYYYMM.json  # 月度总预算
│   ├── expense_YYYYMM.json # 开销记录
│   └── goals.json          # 储蓄目标
└── images/
    └── YYYY-MM-DD_merchant.jpg  # 收据照片

操作 / Operations

1. 记账 / Record Expense

  1. 读取配置 → 获取 paths.data
  2. 解析日期/金额/类型
  3. 读取 expense_YYYYMM.json
  4. 追加新记录(amount 存负数)
  5. 保存回 expense_YYYYMM.json
  6. 返回剩余预算

2. 查状态 / Check Status

  1. 读取配置 → 获取 paths.data
  2. 读取 expense_YYYYMM.json 和 budget_YYYYMM.json
  3. 按工作日/周末分别计算已花/剩余
  4. 输出进度

3. 查开销 / Query Expenses

  1. 读取配置 → 获取 paths.data
  2. 读取 expense_YYYYMM.json
  3. 按日期或分类聚合返回

4. 超支提醒 / Overspend Alert

记账后检查当日累计,超过日预算立即提醒


动态预算机制 / Dynamic Budget

公式

dynamic_budget = (remaining_budget + unused_or_overspend) / remaining_days
  • 未用完的预算 → 加到剩余天数的日预算
  • 超支(赤字) → 从剩余天数的日预算中扣除
  • 工作日和周末分开计算,互不影响

示例 (4月7日查询)

  • 已过: 1工作日(花100.7) + 1周末日(花240.7)
  • 工作日赤字: 100.7 - 100 = -0.7 → 动态日预算 = (1800 + (-0.7)) / 18 = 99.96
  • 周末赤字: 240.7 - 200 = -40.7 → 动态日预算 = (1200 + (-40.7)) / 6 = 193.22

⚠️ 注意事项 / Important

  1. 每次操作前必须读取 config 文件获取最新路径
  2. 所有文件读写只在 paths.root 目录下进行
  3. 不使用统一日均预算,按工作日/周末区分计算
  4. 金额存储为负数(表示支出)
  5. pool name 和 pool id 的映射使用 pool_name_to_id

📖 使用示例 / Usage Examples

记账

用户: 食其家花了37块9
助手: 记上了!✅ 食其家 -37.9元 | 今日已花 37.9元

查今日花销

用户: 今天钱花哪了
助手: 4月5日花销汇总 💸
     食其家 鸡蛋灌饼  20元
     罗森 苏打水      4.8元
     今日合计: 66.8元 | 剩余预算: 3133.2元

查看本月预算状态

用户: 本月还剩多少
助手: 4月预算状态 📊
     总预算: 3300元 | 已花: 239.8元 | 剩余: 3060.2元
     工作日剩余: 1900元 | 周末剩余: 1400元

拍照记账

用户: [发送收据照片]
助手: 看到照片了!这是什么?花了多少?
用户: 便利店买了零食 23块
助手: 记上了!✅ 全家 -23元 | 剩余预算: 3122.2元
      📎 图片已保存: images/2026-04-06_family.jpg

超支提醒

用户: 罗森买水 8块
助手: 记上了!✅ 罗森 -8元
     ⚠️ 今日已花 244.8元,超过周日预算(200元) 44.8元!

Comments

Loading comments...