Subscription Audit

Analyze a bank or card CSV export to surface forgotten, unused, or redundant subscriptions. Categorizes into cancel / review / keep tiers, estimates annual s...

Security Scan

The skill is internally consistent with its stated purpose (CSV-based subscription audit), requires no installs or credentials, and contains only instructions — but it will process sensitive transaction data via whichever model provider you configure, so verify privacy settings or run locally if you need full offline guarantees.

Purpose & Capability

Name, description, and runtime instructions all align: the skill asks users to paste CSVs or a manual list and describes rule-based and LLM-assisted parsing to identify recurring charges. No unexpected binaries, env vars, or external integrations are requested.

Instruction Scope

Instructions are narrowly scoped to parsing pasted transaction CSVs or manual lists and producing a single-response audit. One minor ambiguity: the doc says the initial 'rules-based pass' should run 'no LLM tokens' — but this is an instruction-only skill with no code, so how that deterministic pass is implemented depends on the agent/platform (it may still invoke the model or built-in parsing utilities). Also instructs users to paste raw financial data into chat, which is expected for the task but increases sensitivity.

Install Mechanism

No install spec and no code files; the skill is instruction-only, which minimizes installation risk. Nothing is downloaded or written to disk by the skill itself.

Credentials

The skill requests no environment variables or credentials (appropriate), but it explicitly asks users to paste potentially sensitive transaction data. The SKILL.md/README assert that data 'is not stored or transmitted to any third party' and that it only passes to the configured AI provider — this is a platform-dependent privacy claim and not guaranteed by the skill itself. Users should confirm the retention/privacy policy of their chosen model provider or run a local model (e.g., Ollama) if they require offline processing.

Persistence & Privilege

always is false and the skill does not request persistent presence, nor does it modify other skills or system settings. It is user-invocable and can be called autonomously per platform defaults — this is expected for skills and not itself a security concern here.

Scan Findings in Context

[no_regex_findings] expected: The static regex scanner found no matches because this is an instruction-only skill with no code files. That's expected; absence of findings is not proof of safety — review the SKILL.md instructions (which we did).

Assessment

This skill appears to do what it says and needs nothing beyond the CSV or a manual list. However, you will be pasting sensitive bank/credit-card data into a chat that is processed by your configured model provider. Before using it: (1) confirm your model provider's data-retention and logging policy, (2) consider redacting or anonymizing non-essential fields (account numbers, full card numbers) before pasting, or run the analysis with a local/offline model (the README mentions Ollama) if you require full offline guarantees, (3) treat the README's commercial 'companion tracker' link as an external offer unrelated to the skill's operation, and (4) be aware the skill's claim of a 'rules-based pass without LLM tokens' may be platform-dependent — ask the vendor/platform how deterministic preprocessing is implemented if that matters to you.

Turn a bank or card transaction export into a clear, prioritized action table — tiered by cancel / review / keep priority, with estimated annual spend and savings. No spreadsheet required.

When to use this skill

Trigger this skill when the user:

• Pastes a bank or credit card CSV export and asks about subscriptions, recurring charges, or what they're paying for
• Says "audit my subscriptions," "find my recurring charges," "what am I subscribed to," "what can I cancel"
• Pastes a manual list of subscriptions and asks for analysis or prioritization
• Asks how much they're spending on subscriptions per month or per year

Do NOT trigger for:

• Full budget analysis across all income/expense categories — out of scope
• One-time or non-recurring charges
• Investment or savings account analysis

---

Step 1 — Collect input

Ask the user to provide one of the following. Do not ask for both simultaneously.

Option A: CSV export (preferred)

Bank or card transaction export covering at least 60–90 days. Most banks export from the account activity page under "Download" or "Export."

Ask the user to paste CSV contents directly into chat. Supported formats from all major US banks and credit unions. Minimum useful columns: Date, Description/Merchant, Amount. Accept any superset (Category, Type, etc.) — ignore what you don't need.

Option B: Manual list (fallback)

If the user doesn't have a CSV or prefers not to share one, accept any format:

• Netflix $15.99/mo, Spotify $9.99/mo, Adobe CC $54.99/mo
• A rough list from memory
• A copy-paste from their email receipts

State this limitation once and only once: "Manual lists may miss forgotten subscriptions that don't appear from memory — a bank CSV gives fuller coverage."

---

Step 2 — Identify and classify subscriptions

Rules-based pass (apply first, no LLM tokens)

Flag as subscription if the merchant name matches known patterns:

Streaming & media: Netflix, Hulu, Disney+, Max, Peacock, Paramount+, Apple TV+, Amazon Prime, Spotify, Apple Music, Tidal, Pandora, YouTube Premium, SiriusXM, Audible, Kindle Unlimited

Software & SaaS: Adobe, Microsoft 365, Google One, Dropbox, iCloud, Notion, Canva, Grammarly, LastPass, 1Password, NordVPN, ExpressVPN, Mullvad, Zoom, Slack, GitHub, Figma, Loom, Webflow, Squarespace, Wix, Mailchimp, ConvertKit, Beehiiv

News & content: NYT, WSJ, Washington Post, The Atlantic, Substack, Patreon, Medium

Fitness & wellness: Peloton, ClassPass, Planet Fitness, Equinox, Calm, Headspace, Nike Training Club, Noom, Weight Watchers

Food & delivery: HelloFresh, EveryPlate, Factor, Sunbasket, Green Chef, DoorDash DashPass, Instacart+, Gopuff

Personal finance tools: Credit Karma, LifeLock, IdentityForce, Rocket Money, YNAB, Copilot

Telecom: Cell carriers, internet providers — flag as recurring but mark 🟢 Keep by default; don't recommend cancel without explicit user input

Amazon: Distinguish Prime membership from retail purchases by merchant string pattern

LLM-assisted pass (second pass for unknowns)

For mangled or unrecognized merchant strings (e.g., AMZN*MX7K3B, VZWRLSS*APOP, ACH DEBIT 123456):

• Use amount, frequency, and partial name to infer the service
• If confident (>80%), classify it and note the inference
• If uncertain, flag explicitly as: ⚠️ Confirm — do not guess and present it as fact

Frequency inference

Use recurrence across the date range to infer billing cycle:

• Monthly: charge appears ~every 28–31 days
• Annual: single large charge from a known annual biller — label as annual, not monthly
• Weekly: flag separately; uncommon for subscriptions, may be a gig or delivery service

---

Step 3 — Output the audit

Deliver the full audit in a single response. Structure:

Privacy note (once per session, not repeated on follow-ups)

🔒 Privacy note: This skill does not store, log, or transmit your financial data to any third party. Your transaction data passes only through the AI provider you configured in OpenClaw (e.g., Anthropic, OpenAI) — solely for this analysis, with no retention between sessions. For fully offline processing, configure Ollama as your model provider in OpenClaw settings.

Summary line

X subscriptions found | $Y/month | $Z/year estimated

Audit table

Service	Amount	Freq	Est. Annual	Category	Priority
Netflix	$15.99	Monthly	$191.88	Streaming	🟡 Review
Adobe CC	$54.99	Monthly	$659.88	Software	🟢 Keep
Calm	$69.99	Annual	$69.99	Wellness	🔴 Cancel
ACH*VNDR8K3	$19.99	Monthly	$239.88	?	⚠️ Confirm

Priority tier definitions:

• 🔴 Cancel — no recent activity pattern, clear duplicate of another active service, or user has explicitly said it's unused. Only assign Cancel when there is evidence — not by assumption.
• 🟡 Review — possibly underused, has a direct competitor already in the Keep column, or is a category with 2+ overlapping services. Recommend the user make an active decision.
• 🟢 Keep — clearly active and earning its cost, or a utility/telecom where cancellation has major downstream effects.
• ⚠️ Confirm — merchant identity uncertain; do not classify until user confirms.

Assignment rule: When in doubt between 🔴 and 🟡, use 🟡. Never auto-assign Cancel without a clear reason.

Savings summary

After the table, one short paragraph:

• Total estimated annual spend across all subscriptions
• Estimated annual savings if all 🔴 Cancel items are removed
• The single highest-leverage 🟡 Review item and why it's worth a decision

---

Step 4 — Follow-up offers

After delivering the audit, offer once:

• "Want a focused view of just the 🔴 Cancel items with step-by-step cancellation links?"
• "Want to re-run this with a different date range or more transactions?"
• "Want to track these going forward and get an alert if new recurring charges appear?"

Do not auto-regenerate or add analysis unless explicitly asked.