Nummo

Nummo connects AI agents to the user's bank accounts via Plaid, enabling financial insights through natural language. More info at nummo.ai.

This skill appears to do what it claims (connecting to banks via Plaid and providing summaries/transactions). However, do NOT run the suggested `curl ... | sh` install command without verification: piping a remote script to the shell executes arbitrary code from the site. Before installing or using the CLI, verify the publisher (nummo.ai), check for an official release page or signed installer, and review the install script contents on the server. Ask the vendor for a reproducible, auditable install method (e.g., package on a well-known registry or a downloadable release with checksums). Also confirm the privacy/security details: where transaction data is stored, who can access it, retention policy, and whether the agent or third parties can access raw data. If you prefer safer operation, use the read-only browser-based Plaid Link flows and ensure the agent asks for explicit permission before invoking any commands that access your financial data.

Type: OpenClaw Skill Name: nummo Version: 0.1.8 The `reference/install.md` file instructs users to install the CLI binary using `curl -fsSL https://nummo.ai/install | sh`. This method executes a script downloaded from a remote URL (`https://nummo.ai/install`) directly, posing a significant supply chain risk and potential for arbitrary code execution if the remote server is compromised or the script itself is malicious. While the `SKILL.md` describes a legitimate (though sensitive) financial management skill and includes good agent guidelines, the `curl | sh` installation method introduces a critical security vulnerability, classifying it as suspicious due to high-risk capabilities without clear malicious intent within the provided files.