Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Invoice
v1.1.0Creates and manages invoices as JSON files on GitHub with sequential numbering, preview, and upload.
⭐ 0· 552·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, required env vars (GITHUB_TOKEN, INVOICE_REPO), and required binaries (curl, python3, base64) match the implemented behavior: listing, previewing, numbering, and pushing invoice JSON files to GitHub via the API.
Instruction Scope
SKILL.md explicitly requires executing included scripts (get-next-number.sh, calc-preview.sh, push-invoice.sh). Those scripts operate only against the GitHub API and local JSON input. The doc says sender data is loaded from data.json or previous invoices but does not include an explicit helper that always fetches data.json — the assistant would need to call the provided get-invoices/get file flow to retrieve it. Also the preview output contains invoice sensitive data (bank/IBAN), which is expected but worth noting.
Install Mechanism
No install spec; this is instruction + script-only. Nothing is downloaded from external arbitrary URLs or written to system locations during install. Risk surface is limited to executing the included scripts at runtime.
Credentials
Requested env vars (GITHUB_TOKEN and INVOICE_REPO) are necessary for the GitHub operations. Caveat: the token must be scoped appropriately — a PAT with broad repo/org permissions could be misused if INVOICE_REPO is misconfigured. README recommends a fine-grained PAT scoped to a single repo, which is the correct practice.
Persistence & Privilege
Skill is not always-on and is user-invocable. claw.json requests network and exec permissions (expected for this functionality). The skill does not modify other skills or system-wide settings.
Assessment
This skill is internally consistent with its purpose, but before installing: 1) Use a fine-grained GitHub token limited to the single invoice repository (avoid broad repo/org tokens). 2) Ensure INVOICE_REPO is set to the intended private repo (the scripts will create/update files there and assume branch 'main'). 3) Be aware invoice previews contain sensitive data (IBAN, addresses) which will be displayed in the assistant's messages — test with a throwaway/private repo first. 4) Confirm your environment is Linux and has the specified binaries. If you need the skill to only read data.json automatically, verify the agent uses get-invoices.sh/get file calls to fetch it (SKILL.md mentions it but does not add an automated fetch helper).Like a lobster shell, security has layers — review code before you run it.
latestvk978ntb9akzpn2dp65v2pnfk8x81b1jg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
OSLinux
Binscurl, python3, base64
EnvGITHUB_TOKEN, INVOICE_REPO
Primary envGITHUB_TOKEN