理财小助手

理财小助手，收支记录、消费分析、预算提醒。

Security Scan

The skill's description matches a personal finance helper, but the runtime instructions call a Python script that is not provided or installed by the skill and they operate on files under your home directory, creating an incoherent and potentially risky situation.

Purpose & Capability

Name/description correspond to a personal finance helper and the declared dependency (python3) is appropriate. However, the SKILL.md expects a script named pocket-money-manager.py to exist and be runnable; no code files or install steps are provided, so it's unclear how the described functionality would actually be delivered.

Instruction Scope

Instructions tell the agent to run python pocket-money-manager.py commands and reference local storage paths (~/.memory/finance/records.json and budget.json). That is coherent for a finance app, but because the skill supplies no implementation, the agent would attempt to execute a script that may not exist — or could run an existing file on the user's system with that name. The instructions read/write files in the user's home, which may contain sensitive financial data.

Install Mechanism

There is no install spec (instruction-only), which is lower-risk than pulling and executing remote archives. The downside is lack of an included, auditable implementation.

Credentials

The skill does not request environment variables or external credentials, which is proportionate. It does, however, operate on local files in the user's home directory for storing records/budgets — reasonable for a finance tool but sensitive in nature and worth auditing.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or cross-skill privileges. It does instruct read/write to user-local paths but does not claim system-wide persistence.

What to consider before installing

This skill's intent (personal bookkeeping) is plausible, but the SKILL.md expects a local Python script pocket-money-manager.py that the skill does not provide or install. Before installing or invoking it: 1) Verify the referenced GitHub repo and confirm where pocket-money-manager.py comes from; don't run the skill unless you can inspect the script's source. 2) If you have a file with the same name on your system, be aware the skill would execute it — review that file for malicious behavior. 3) Because it reads/writes ~/.memory/finance/*.json (sensitive financial data), ensure backups and audit file access. 4) Prefer a skill that includes an install spec or an auditable package, or run any untrusted script in a sandbox/container. If you cannot confirm the script's origin and contents, avoid enabling this skill.

理财小助手 (Pocket Money Manager)

你的私人记账管家。

功能

• 记收入（工资/奖金/兼职/理财/红包）
• 记支出（餐饮/交通/购物/住房/娱乐/医疗/教育）
• 查看余额和收支统计
• 周消费报告
• 设置月预算
• 超支预警提醒

使用示例

# 记收入
python pocket-money-manager.py add_income 5000 工资

# 记支出
python pocket-money-manager.py add_expense 35 餐饮

# 查看余额
python pocket-money-manager.py get_balance

# 周报告
python pocket-money-manager.py get_weekly_report

# 设置预算
python pocket-money-manager.py set_budget 3000

数据存储

• 收支记录: ~/.memory/finance/records.json
• 预算设置: ~/.memory/finance/budget.json

---

By Miya - 2026