MILKEE Swiss Accounting

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 2.0.0
• Hash: 6ee0886ef3765b2c80b9dedbb58823d29d5316bdb3711487230fca5bdb76da61
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill 'milkee' is a benign integration for MILKEE accounting software. It securely retrieves API credentials from environment variables (`MILKEE_API_TOKEN`, `MILKEE_COMPANY_ID`) and communicates exclusively with the legitimate MILKEE API at `https://app.milkee.ch/api/v2`. The skill uses a local file `~/.milkee_timer` to store temporary timer state, which is a standard and non-malicious practice, and it is cleaned up after use. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` or other documentation. All code and instructions align with the stated purpose of managing accounting data.