Track expenses and income with multi-backend storage (local/Notion/Google Sheet/Supabase). Credentials are encrypted with AES-256-GCM. Use when user wants to...

What to check before you install or run this skill: - Review the full script contents (the provided file listing was truncated); ensure the rest of the code contains only the expected CLI parsing and no hidden network endpoints or telemetry. If you can, open the complete scripts/expense-tracker.js. - Do not paste real API keys or master passwords until you validate the code. Instead, test with throwaway/test credentials or in a sandboxed account. - The script saves encrypted credentials to ~/.openclaw/expense-tracker/config.enc and stores records in ~/expenses.json by default — back up any existing files and be comfortable with those file locations. - The crypto choices are reasonable (AES-256-GCM, PBKDF2 with 100k iterations), but the implementation has bugs: there are incorrect readline/question usages and a likely bug in decrypt (concatenation of Buffer and string), which can break decryption and risk losing access to stored credentials/data. Expect to test and possibly fix the code before relying on it. - The script calls network APIs only for Notion and Supabase using the keys you provide; verify there are no other unexpected domains in the remainder of the file. - Ensure you run under a supported Node runtime (script uses fetch and assumes Node global fetch; Node 18+ recommended) and consider running it inside a container or throwaway environment first. If you want, I can: (1) fetch and analyze the rest of the truncated file (if you provide it), (2) point out exact lines that need fixing for the password prompts and decryption, or (3) produce a safer drop-in replacement for the buggy functions.

Type: OpenClaw Skill Name: expense-tracker-v2 Version: 1.1.0 The OpenClaw AgentSkills skill bundle implements an expense tracker with multiple storage backends. While the `SKILL.md` and cryptographic implementation appear benign, the `scripts/expense-tracker.js` file contains significant vulnerabilities. The `setup` command allows the user to specify an arbitrary file path for local data storage, which could lead to path traversal and arbitrary file read/write if a malicious path is provided. Furthermore, the Supabase backend allows a user-defined URL, which could be abused for data exfiltration of expense data and API keys if configured to an attacker-controlled endpoint. These are vulnerabilities that could be exploited, but they do not demonstrate clear malicious intent by the developer to exfiltrate data to a hardcoded malicious destination or install backdoors.