unified-invoice

통합 견적서/세금계산서 생성기. 한국형 견적서(사업자등록번호, 부가세) + 프리랜서 인보이스(다국어, VAT). 거래처/품목 DB, PDF 출력, 자동 계산.

This skill appears coherent and implements a local invoice generator. Before installing: 1) Review data/my-info.json and remove any sensitive bank/account identifiers you don't want stored. 2) npm install will fetch puppeteer-core — run it in a controlled environment and ensure a compatible OpenClaw browser is running at http://localhost:18800 (SKILL.md notes this). 3) Note the scripts will create files under the skill directory and a workspace path (default $HOME/.openclaw/workspace) and write event JSON files; if you have policy concerns about file locations, set WORKSPACE/EVENTS_DIR explicitly. 4) If you require network isolation, ensure the local browser connection is permitted only to localhost. 5) If you want extra assurance, run the scripts in a sandbox and inspect their output files; there are no hidden remote endpoints or declared secret/env requirements beyond optional WORKSPACE/EVENTS_DIR and the local browser port.

Type: OpenClaw Skill Name: unified-invoice Version: 1.1.0 The skill is classified as suspicious due to significant input sanitization vulnerabilities. The `scripts/freelance-run.sh` script directly embeds user-provided arguments (e.g., `--service`, `--client`) into a generated Markdown file without proper escaping, creating a prompt injection risk if an AI agent processes this Markdown. Similarly, the `scripts/generate.js` script inserts user-provided input (e.g., `options.notes`, `item.name`) directly into HTML templates without sanitization, leading to HTML injection/XSS vulnerabilities in the generated HTML/PDF documents. These flaws allow for potential attacks but do not show clear evidence of intentional malicious behavior like data exfiltration or unauthorized remote control.