Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

SCF Quick Compare

v1.0.2

Period-over-period variance analysis on the Statement of Cash Flows pulled from QuickBooks Online. Outputs a 4-tab Excel workbook: Summary, Detail, Flags, CD...

0· 219·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for samledger67-dotcom/scf-quick-compare.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "SCF Quick Compare" (samledger67-dotcom/scf-quick-compare) from ClawHub.
Skill page: https://clawhub.ai/samledger67-dotcom/scf-quick-compare
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install scf-quick-compare

ClawHub CLI

Package manager switcher

npx clawhub@latest install scf-quick-compare
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The stated purpose (SCF variance analysis from QuickBooks Online) reasonably requires QBO credentials and code to call the QBO API and produce Excel output. However, the skill advertises a Python script path but also says it needs a 'Node.js QBO client with valid auth token' — mixing runtimes. The registry metadata also declares no required env vars or credentials despite repeatedly saying 'QBO credentials configured' are required. These mismatches are not proportionate to the stated purpose.
!
Instruction Scope
SKILL.md instructs running scripts/pipelines/scf-quick-compare.py, uses a QBO auth token, and reads/writes local cache (.cache/scf-quick-compare/{slug}.json) and defaults to saving to the user's Desktop. There are no instructions explaining where QBO credentials/tokens live or how they are supplied, and the runtime described (Python script calling a Node client) is incoherent. Instructions do not ask for unrelated system data, but the missing detail about credential handling and files is problematic.
Install Mechanism
This is instruction-only with no install spec — lower surface risk in that nothing is automatically downloaded. However, the docs claim 'pip install openpyxl (already installed in workspace)' and require a Node.js QBO client but provide no install instructions or package names. The absence of shipped code means the described script isn't present in the package, which is an inconsistency (either missing files or inaccurate documentation).
!
Credentials
The skill clearly needs QuickBooks Online credentials/tokens to function, but the registry lists no required env vars, primary credential, or config paths. Requesting access to QBO (sensitive financial data) without declaring how credentials are provided is disproportionate and opaque. The skill also writes a local cache and outputs to Desktop, which are reasonable but should be documented.
Persistence & Privilege
always:false and no special privileges — normal. The skill will create a local cache (.cache/scf-quick-compare/{slug}.json) and write output spreadsheets to the Desktop or --out directory. This local persistence is expected for a reporting tool but should be made explicit in install/run docs and permission reviews.
What to consider before installing
Do not install or run this skill until the author clarifies and/or provides the missing pieces. Specifically: 1) Ask for the actual code files (scripts/pipelines/scf-quick-compare.py and any Node client) — the package currently contains only SKILL.md. 2) Ask how QBO credentials/tokens are supplied (which env vars or config file) and never provide production QBO credentials until you can review the code. 3) Clarify the runtime: is this a Python script, a Node program, or a hybrid? Provide install steps for Node packages and Python deps. 4) Verify where outputs and caches are written (defaults to Desktop and .cache) and consider running first in a sandboxed environment or with QBO sandbox credentials. 5) If the author cannot provide source or precise credential handling, treat this as untrusted: avoid giving real QBO tokens and prefer alternatives (a vetted plugin, sandbox credentials, or manual export/import).

Like a lobster shell, security has layers — review code before you run it.

latestvk979mh0kp3d346ypg38ah74q1s83chcj
219downloads
0stars
3versions
Updated 22h ago
v1.0.2
MIT-0

SCF Quick Compare — Skill

What This Skill Does

Runs a period-over-period variance analysis on the Statement of Cash Flows (SCF) pulled directly from QuickBooks Online. Outputs a 4-tab Excel workbook: Summary | Detail | Flags | CDC Log.

Mirrors the pl-quick-compare pattern exactly but for the Cash Flow Statement — Operating / Investing / Financing sections, balance validation, and SCF-specific analysis notes on flagged items.

When to Use

Use when:

  • A client needs month-over-month or YTD cash flow variance analysis
  • Reviewing SCF as part of monthly close deliverables
  • Investigating a material shift in operating, investing, or financing cash flows
  • Client asks: "why did our cash position change?" or "what drove the cash swing?"

NOT for:

  • 13-week rolling cash flow forecasting → use cash-flow-forecast.py
  • P&L variance analysis → use pl-quick-compare.py
  • AR aging / collections tracking → use ar-collections
  • Balance sheet analysis (not cash flows)

Script Location

scripts/pipelines/scf-quick-compare.py

Requirements

  • pip install openpyxl (already installed in workspace)
  • Node.js QBO client with valid auth token
  • QBO credentials configured

Usage

# Current month vs. prior month (auto-detects prior)
python3 scripts/pipelines/scf-quick-compare.py \
    --slug my-client \
    --current-start 2026-03-01 --current-end 2026-03-31

# Explicit prior period
python3 scripts/pipelines/scf-quick-compare.py \
    --slug my-client \
    --current-start 2026-02-01 --current-end 2026-02-28 \
    --prior-start 2026-01-01 --prior-end 2026-01-31

# YTD vs prior YTD (Jan 1 → end of last completed month)
python3 scripts/pipelines/scf-quick-compare.py \
    --slug my-client --ytd --year 2026

# Custom output directory
python3 scripts/pipelines/scf-quick-compare.py \
    --slug my-client \
    --current-start 2026-03-01 --current-end 2026-03-31 \
    --out ~/Desktop/reports

# Sandbox mode (QBO sandbox environment)
python3 scripts/pipelines/scf-quick-compare.py \
    --slug my-client \
    --current-start 2026-03-01 --current-end 2026-03-31 \
    --sandbox

Arguments

FlagRequiredDescription
--slugCompany slug (must be connected in qbo-client)
--current-start✅*Current period start date (YYYY-MM-DD)
--current-end✅*Current period end date (YYYY-MM-DD)
--prior-startPrior period start (auto-shifts 1 month if omitted)
--prior-endPrior period end (auto-shifts 1 month if omitted)
--ytd✅*YTD mode (alternative to explicit dates)
--yearYear for --ytd (default: current year)
--outOutput directory (default: ~/Desktop)
--sandboxUse QBO sandbox environment

*Either --current-start/--current-end OR --ytd is required.

Output

Excel file: SCF_QuickCompare_{slug}_{period}.xlsx saved to Desktop (or --out directory).

Tab 1: Summary

  • Operating / Investing / Financing section totals (current vs prior, $ variance, % variance, F/U)
  • Net Change in Cash
  • Beginning and Ending Cash Balance
  • SCF validation: Operating + Investing + Financing = Net Change and Beginning + Net Change = Ending Cash

Tab 2: Detail

  • Every SCF line item with hierarchy preserved
  • Prior period | Current period | $ Variance | % Variance | F/U label
  • Color-coded by section (Operating = blue, Investing = gold, Financing = purple)

Tab 3: ⚠ Flags

  • Material variances: ≥10% change OR ≥$2,500 absolute
  • Analysis note for each flagged item — plain-English explanation of what the variance likely means
  • SCF-specific interpretation (AR buildup, D&A add-back, capex, debt repayment, distributions)

Tab 4: CDC Log

  • Change Data Capture: compares current SCF flat map against last cached run
  • First run: full snapshot saved (no deltas)
  • Subsequent runs: shows exactly what line items changed since last run
  • Cache location: .cache/scf-quick-compare/{slug}.json

SCF Logic

Section Classification

The parser classifies each QBO CF row into sections by keyword matching on row names:

  • Operating: net income, depreciation, amortization, AR, AP, inventory, prepaid, accrued, working capital
  • Investing: equipment, property, asset, purchase, capex, investing
  • Financing: loan, line of credit, note payable, distribution, equity, contribution, SAFE, financing
  • Net Change: net change, net increase/decrease in cash
  • Beginning/Ending Cash: beginning, ending (balance check rows)

Variance F/U Logic

For SCF: positive delta = Favorable (more cash generated/retained vs prior). This is directionally correct for all sections — the goal is always more net cash.

Balance Validation

Net Change = Operating + Investing + Financing      (≤$1 tolerance)
Ending Cash = Beginning Cash + Net Change           (≤$1 tolerance)

Both checks run on both periods and displayed in the Summary tab.

YTD Mode

--ytd: Current = Jan 1 → end of last completed month. Prior = same date range in prior year. Example: run on March 17, 2026 → Current = Jan 1 – Feb 28, 2026 | Prior = Jan 1 – Feb 28, 2025.

Analysis Notes (Flags Tab)

The Flags tab includes an Analysis Note column with SCF-specific interpretation for each material variance:

ItemNote logic
Net IncomeProfitability driver — directs to P&L for root cause
Depreciation / AmortizationNon-cash add-back explanation
Accounts ReceivableAR buildup (cash tied up) vs. collection acceleration
Accounts PayableAP extension (cash benefit) vs. paydown (cash use)
InventoryBuildup (cash use) vs. drawdown (cash release)
Equipment / CapExStrategic capex alert — verify against growth plan
Loan proceeds / repaymentsDebt structure activity — review debt schedule
DistributionsOwner draw alert — verify cash availability
SAFE / EquityCap table activity — verify with investor records
Net ChangeOverall cash generation summary

CDC Cache

.cache/scf-quick-compare/{slug}.json

Stores the flat map of all SCF line names → amounts for the most recent run. On re-run, diffs against the prior cache and shows exactly what changed. Useful for catching mid-month QBO adjustments or reconciliation entries.

Decimal Math

All calculations use Python Decimal with ROUND_HALF_UP — no floating-point rounding errors in financial outputs.

Comments

Loading comments...