Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TCS Expense Claim Processor

v1.0.0

End-to-end business travel expense claim processor. Use this skill whenever a user uploads receipts, bills, invoices, or screenshots of expenses and wants to...

1· 82·0 current·0 all-time
byArun Prasad@insanelyqurious

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for insanelyqurious/tcs-expense-claim.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "TCS Expense Claim Processor" (insanelyqurious/tcs-expense-claim) from ClawHub.
Skill page: https://clawhub.ai/insanelyqurious/tcs-expense-claim
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tcs-expense-claim

ClawHub CLI

Package manager switcher

npx clawhub@latest install tcs-expense-claim
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The description (end-to-end expense claim processing) aligns with the two included scripts (PDF merging and XLSX generation) and the TCS category docs. However, the SKILL.md requires visual extraction/OCR and automatic classification of receipts (Phase 1 & 2), yet there is no code provided to perform OCR or automated parsing — the included scripts only consume pre-structured JSON manifests. This gap means the skill as packaged is not fully implementing its claimed end-to-end capability.
!
Instruction Scope
The runtime instructions tell the agent to list and read files in /mnt/user-data/uploads/ and to 'read visually' to extract invoice data. They also reference script paths like scripts/build_pdfs.py and scripts/build_xlsx.py and documents at /mnt/skills/public/pdf/SKILL.md and /mnt/skills/public/xlsx/SKILL.md. In the package, the actual script files are build_pdfs.py and build_xlsx.py at the repository root (no scripts/ directory) and the referenced public SKILL.md/xlsx files are not present. These path mismatches and the broad 'read visually' instruction (which implies OCR/vision capabilities) are inconsistencies that could cause runtime errors or unexpected agent behavior.
Install Mechanism
There is no install spec (instruction-only), which minimizes install-time risk. The Python scripts require third-party packages (openpyxl, pypdf, img2pdf, Pillow) but the skill does not declare dependencies or provide an install step — SKILL.md prints pip install hints. This is a modest operational risk (missing deps) but not an execution-of-untrusted-code-red-flag by itself.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The files and outputs are constrained to /mnt/user-data/uploads/ and /mnt/user-data/outputs/, which fits the stated purpose of processing user-uploaded receipts.
Persistence & Privilege
The skill does not request always:true and is user-invocable only; it does not request elevated or persistent privileges. Autonomous invocation is allowed by default but is not combined here with broad credential access or other concerning privileges.
What to consider before installing
This skill appears to be a plausible receipt-packaging helper, but it is incomplete and inconsistent in important ways. Before installing or using it: - Confirm the source/author (no homepage provided) — avoid running unknown scripts on sensitive data. - Verify where the scripts actually live and update SKILL.md references (SKILL.md expects scripts/ but files are at repo root). - Note that there is no OCR/parsing implementation included: you or the agent must produce the structured JSON manifests (expenses.json / bills_manifest.json) that the included scripts consume. If you expect the skill to extract text from images automatically, it does not do that as packaged. - Ensure required Python packages (openpyxl, pypdf, img2pdf, Pillow) are available in the runtime; the skill suggests pip hints but doesn't install them. - The code itself has no network endpoints or secret access, but SKILL.md suggests fetching live FX rates 'if web search is available' — clarify whether that will cause network calls in your environment and whether you are comfortable with that. - Test on non-sensitive sample receipts first to validate file paths, manifests, and outputs. If you need true end-to-end automated OCR and classification, request or implement an OCR/parsing component and fix the path mismatches before trusting this skill with real expense data.

Like a lobster shell, security has layers — review code before you run it.

currencyvk97ffghk6gx5yhxxc639v1sq9h849hrxexpensevk97ffghk6gx5yhxxc639v1sq9h849hrxfinancevk97ffghk6gx5yhxxc639v1sq9h849hrxlatestvk97ffghk6gx5yhxxc639v1sq9h849hrxlatestlatestvk97ffghk6gx5yhxxc639v1sq9h849hrxpdfvk97ffghk6gx5yhxxc639v1sq9h849hrxreceiptsvk97ffghk6gx5yhxxc639v1sq9h849hrxreimbursementvk97ffghk6gx5yhxxc639v1sq9h849hrxtcsvk97ffghk6gx5yhxxc639v1sq9h849hrxtravelvk97ffghk6gx5yhxxc639v1sq9h849hrxxlsxvk97ffghk6gx5yhxxc639v1sq9h849hrx
82downloads
1stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Expense Claim Skill

Automates the full workflow of turning a pile of receipt images and PDFs into clean, submission-ready expense claim packages — sorted by date and category, with currency conversions and a summary table.


Workflow Overview

Run these five phases in order. Never skip a phase.

Phase 1 → Ingest & Parse all uploaded files
Phase 2 → Classify each bill (date, vendor, category, currency, amount)
Phase 3 → Generate per-day per-category PDFs
Phase 4 → Generate the expense spreadsheet (XLSX)
Phase 5 → Output summary tables for manual form entry

Phase 1 — Ingest & Parse

  1. List every file in /mnt/user-data/uploads/
  2. For each file:
    • Images (.png, .jpg, .jpeg): read visually — extract date, vendor, amount, currency, bill number, and any GST/VAT breakdown
    • PDFs (.pdf): use pypdf to extract text; if text is sparse, treat as scanned and read visually
  3. Ask the user if any files are missing or unreadable before proceeding

Phase 2 — Classify

Map every bill to this schema:

date        : DD-Mon-YY   (e.g. 13-Feb-26)
vendor      : string
location    : city / airport / country
category    : one of the TCS categories below
currency    : INR | USD | EUR | GBP | SGD | AED | ...
amount_orig : float (as printed on bill)
bill_no     : string (from receipt; use "attached" if none)
notes       : brief description of items

TCS Expense Categories (map every bill to one)

TCS CategoryWhat goes here
Travel Expenses – ConveyanceUber, Ola, Lyft, taxis, local cabs, airport transfers
Ticket Expenses – Air TicketsAirline tickets, excess baggage fees (keep SEPARATE per bill)
Ticket Expenses – Train TicketsRail bookings
Ticket Expenses – Bus TicketsBus / coach bookings
Hotel AccommodationHotel folios, checkout invoices (NOT room dining — that's Meal)
Travel Expenses – MealAll food, beverages, airport snacks, restaurant bills, delivery (Zomato/Swiggy), cafe receipts
Client Entertainment – TravelMeals/entertainment where clients were present
Car ExpensesFuel, parking, tolls
Communication ExpensesSIM cards, roaming, internet dongles
Conference and Training CoursesRegistration fees, course materials

Special Rules

  • Room dining at a hotel → Meal (NOT Hotel Accommodation)
  • Zomato/Swiggy orders: bundle restaurant bill + platform fee + delivery fee into ONE line item with the combined total
  • Delta / airline excess baggage → Air Tickets (separate PDF per bill)
  • Airport retail (water, snacks, chocolates) → Meal
  • Sweets / gifts (e.g. Kantis, mithai shops) → Meal (flag with note: "verify if gift policy applies")
  • Multiple bills same day same category → merged into one PDF

Phase 3 — Generate PDFs

Read /mnt/skills/public/pdf/SKILL.md before running this phase.

Naming convention:

DD_Mon_YYYY_<TCS_Category_Underscored>.pdf

Examples:

13_Feb_2026_Travel_Expenses_Conveyance.pdf
13_Feb_2026_Travel_Expenses_Meal.pdf
13_Feb_2026_Ticket_Expenses_Air_Tickets.pdf
20_Feb_2026_Hotel_Accommodation.pdf

Script to use: scripts/build_pdfs.py

  • Converts images → PDF pages using img2pdf + Pillow
  • Merges existing PDFs using pypdf
  • Outputs to /mnt/user-data/outputs/bills_by_category/

Run: python3 scripts/build_pdfs.py

Present all generated PDFs to the user using present_files.


Phase 4 — Generate XLSX Summary

Read /mnt/skills/public/xlsx/SKILL.md before running this phase.

Script to use: scripts/build_xlsx.py

The spreadsheet has two sheets:

Sheet 1: "All Expenses"

Columns: #, Date, Vendor, Location, Category, Currency, Amount (Original), Amount (INR equiv.), Notes

Color coding:

  • Blue fill → Travel / Conveyance / Air Tickets
  • Green fill → Food & Meal
  • Orange fill → Accommodation
  • Purple fill → Other

Sheet 2: "Summary"

Rows = TCS categories; Columns = Category, # Items, Original Amounts, INR Equiv. Plus a Grand Total row with all-in USD equivalent.

Currency conversion — use rates from references/fx_rates.md or fetch live rates if web search is available. Always show the rate used and its date.

Output to /mnt/user-data/outputs/expense_claim.xlsx


Phase 5 — Summary Tables for Manual Entry

Always output three tables in chat so the user can fill their expense portal directly:

Table A: Conveyance entries

Bill Date | From Location | To Location | Bill No | Currency | Amount | Remarks

Table B: Meal entries

Bill Date | Name of Hotel/Restaurant | Bill No | Currency | Amount | Remarks

Table C: Hotel entries

Bill Date | From Date | To Date | Bill No | Currency | Amount | Remarks

Table D: Air Ticket entries

Bill Date | Bill No | Currency | Amount | Remarks

Table E: Day-wise spend summary

Date | Conveyance | Air Ticket | Hotel | Meal (local currency) | Day Total (USD) — Include a GRAND TOTAL row at the bottom.


Currency Conversion Rules

See references/fx_rates.md for standard rates.

  • Always convert everything to INR for Indian domestic claims
  • Always convert everything to USD for international / global summary
  • Show the exchange rate used in every table and in the XLSX notes
  • If the trip spans multiple currencies, show original + converted in the XLSX
  • Flag any bill where the currency on the receipt doesn't match the card currency (possible forex fee)

Output Checklist

Before finishing, confirm all of these exist:

  • One PDF per day per category in /mnt/user-data/outputs/bills_by_category/
  • expense_claim.xlsx with both sheets
  • Table A–E printed in chat
  • Grand total in USD stated clearly
  • Any flagged items noted (gift policy, missing bills, illegible receipts)

Error Handling

ProblemAction
Can't read a receiptNote it, ask user to confirm amount manually
Date missing from billInfer from surrounding bills or ask user
Currency ambiguousDefault to country of purchase; flag for user
Bill number not on receiptUse "attached"
Multiple receipts same vendor same dayMerge into one line, note qty

Reference Files

  • references/fx_rates.md — Standard FX rates for common travel corridors
  • references/tcs_categories.md — Full TCS category eligibility rules
  • scripts/build_pdfs.py — PDF generation script
  • scripts/build_xlsx.py — Excel generation script

Comments

Loading comments...