Taxi Expense

识别滴滴打车订单截图，OCR识别文字+坐标，马赛克脱敏目的地，按月生成报销Excel

Security Scan

The skill's files, dependencies, and runtime instructions are coherent with its stated purpose (OCR taxi screenshots, desensitize destinations, generate monthly Excel); issues are implementation bugs and operational notes rather than signs of malicious intent.

Purpose & Capability

Name/description, README, SKILL.md, package.json and the two scripts all consistently implement OCR (tesseract.js), image processing (sharp) and Excel generation (exceljs). The declared dependencies and setup script match the stated purpose. Minor mismatch: SKILL.md and README mention storing files under ~/.openclaw/workspace/taxi_expense/, but process.js uses paths relative to the scripts directory (scripts/taxi_data.json, scripts/screenshots). This is a usability/packaging inconsistency, not an indication of unrelated capability requests.

Instruction Scope

Runtime instructions are narrowly scoped to local OCR, parsing, masking, saving screenshots and producing Excel. The SKILL.md suggests optionally sending the final file via an openclaw CLI telegram command (user-triggered). Concerns: process.js expects an existing taxi_data.json and screenshots directory (it reads DATA_FILE without checking existence), and worker langPath is set to /tmp/tessdata while setup.sh writes tessdata into the skill directory — this mismatch may cause runtime failures unless user provides traineddata at /tmp/tessdata or modifies config.

Install Mechanism

No platform install spec in registry; setup.sh runs npm install locally and downloads Tesseract traineddata from GitHub raw (https://github.com/tesseract-ocr/tessdata/raw/...), which is a known upstream. Installing sharp may pull native binaries and requires build/toolchain on host; setup.sh runs in the skill folder and is explicit about where it writes data. No obscure or third-party personal servers or shortened URLs are used.

Credentials

The skill requests no credentials or sensitive environment variables. setup.sh optionally respects http_proxy/HTTP_PROXY to fetch training data, which is normal. There are no requests for unrelated secrets or config paths.

Persistence & Privilege

Skill is not forced-always; it is user-invocable and may be invoked by the agent normally. It writes files to the skill workspace (taxi_data.json, screenshots, monthly Excel) which is expected for this functionality. It does not modify other skills or system-wide configuration.

Assessment

This skill appears to do what it says, but check a few practical points before use: - Paths: process.js reads/writes taxi_data.json and screenshots relative to the scripts directory, while SKILL.md/README reference ~/.openclaw/workspace/taxi_expense/ — decide which path you want and adjust files or move/copy taxi_data.json and tessdata accordingly. - Create initial files/dirs: create an initial taxi_data.json (an empty JSON array: []) and the screenshots directory in the same directory as process.js to avoid crashes. - Tesseract traineddata: setup.sh writes tessdata into the skill's tessdata directory, but process.js config points to /tmp/tessdata. Either place traineddata in /tmp/tessdata or edit process.js to point to the skill tessdata directory. - Network & build: setup.sh runs npm install and downloads large traineddata files from GitHub; ensure the host environment allows network access and has the build/runtime requirements for sharp (native binaries). Use a proxy if required (http_proxy/HTTP_PROXY supported). - Review generated output before sharing: the script masks destination text and images, but OCR errors and masking heuristics can produce edge cases — verify sensitive content in produced XLSX and screenshots before sending to others. - Audit before automation: the code performs only local I/O and image processing. If you plan to add automated sending (openclaw message send), confirm recipient/channel configuration to avoid accidental data exfiltration. If you want, I can suggest minimal edits to process.js and setup.sh to make paths consistent, add safe existence checks (create taxi_data.json if missing), and make the tessdata path configurable.

When user sends taxi order screenshots:

Setup (first time only)

bash ~/.openclaw/workspace/skills/taxi_expense/scripts/setup.sh

Process Screenshots

node ~/.openclaw/workspace/skills/taxi_expense/scripts/process.js <image1> [image2] ...

The script will:

1. OCR each image with Tesseract.js v4 (uses coordinates to detect text positions)
2. Parse orders: date, time, start/end point, amount
3. Smart amount extraction: handles OCR misreads (¥→%, missing ¥, missing decimal)
4. Filter: only weekday evening rides (after 21:00) qualify for reimbursement
5. Auto-exclude closed/cancelled orders (amount = ¥0)
6. White block desensitization on destination address in screenshots (keeps first/last char visible)
7. Desensitize destination text in Excel (e.g. 古*****门)
8. Save screenshots to ~/.openclaw/workspace/taxi_expense/screenshots/
9. Update ~/.openclaw/workspace/taxi_expense/taxi_data.json (auto-dedup by date+amount)
10. Generate monthly Excel: ~/.openclaw/workspace/taxi_expense/YYYY-MM-taxi_expense.xlsx

Excel Columns

序号 | 日期 | 星期 | 时间 | 起点 | 终点(脱敏) | 金额 | 备注

Sheet 2 contains mosaiced order screenshots.

Output

Tell user:

• How many new orders were added
• Monthly totals (reimbursable orders only)
• Any skipped orders and why (weekend, before 21:00, closed, ¥0)

Send Preview (only if user asks)

The script saves desensitized screenshots to the screenshots/ directory. Send via:

openclaw message send --channel telegram --target <chat_id> --message "msg" --media <file.xlsx>

Known Issues

• Tesseract Chinese quality is imperfect ("点"→"炭", "轻享"→"轻亭")
• Uses regex /终[点炭]/ for tolerant matching
• Amount recognition: ¥ may be misread as % or lost entirely
• Amount > 500 is auto-corrected (missing decimal: 1970→19.70)
• Source images must be ORIGINAL screenshots (not previously processed/cropped)
• Multiple images supported: node process.js img1 img2 img3