Manage PocketSmith transactions, categories, budgets and financial data

Manage PocketSmith transactions, categories, and financial data via the API

This skill appears to do exactly what it says: a CLI for the PocketSmith API. Before installing, consider: (1) the developer key gives access to your PocketSmith account — only install if you trust the skill and source; (2) write operations are disabled by default — only set POCKETSMITH_ALLOW_WRITES=true when you intend to perform adds/edits/deletes; (3) the package depends on httpx and will make network calls to api.pocketsmith.com (expected); (4) if you want additional assurance, review the GitHub repo referenced in the README yourself, or create a scoped developer key in PocketSmith for use with this skill and store it securely in your environment. No evidence of hidden endpoints, unrelated credential requests, or filesystem exfiltration was found.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 5 The OpenClaw AgentSkills skill bundle for PocketSmith is benign. It provides a CLI for managing PocketSmith financial data via its official API. The skill correctly retrieves the `POCKETSMITH_DEVELOPER_KEY` from environment variables for authentication and explicitly protects all write operations (create, update, delete) by requiring the `POCKETSMITH_ALLOW_WRITES=true` environment variable, as seen in `src/pocketsmith/cli.py` and documented in `SKILL.md` and `README.md`. All network communication is directed to the legitimate PocketSmith API at `https://api.pocketsmith.com/v2` (defined in `src/pocketsmith/client.py`). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent in any of the provided files.