Nova Net Worth

Query your Nova Net Worth financial data — net worth, accounts, holdings, goals, spending, transactions, AI insights, and health score. Use when the user ask...

This skill appears to be what it claims: a client for the Nova Net Worth API that only needs your NOVA_API_KEY. Before installing, consider: (1) only provide a key you trust the service with — prefer a read-only or limited-scope key if Nova supports it; (2) confirm you trust app.novanetworth.com and its privacy/security posture because the script will send all financial queries there; (3) note the small inconsistency in the holdings endpoint path (may cause a command to fail) — treat it as a bug, not evidence of exfiltration; (4) do not paste your API key into public chat or logs; (5) if you want extra assurance, inspect the remainder of the script and test with an account that has minimal data/permissions. If you want, I can point out the exact lines that perform network requests and show what hosts will be contacted.

Type: OpenClaw Skill Name: nova-net-worth Version: 1.3.1 The OpenClaw skill 'nova-net-worth' is a legitimate client for the Nova Net Worth API. It correctly uses environment variables for the API key (`NOVA_API_KEY`), validates its format, and directs all network communication to the expected `api.novanetworth.com` endpoint (or an optionally configured `NOVA_API_URL`). Command-line arguments are parsed and used to construct URL query parameters via `URLSearchParams`, which inherently handles URL encoding, mitigating injection risks. There is no evidence of intentional malicious behavior, data exfiltration, arbitrary code execution, persistence mechanisms, or prompt injection attempts against the agent within the provided files.