Multi-Channel Income Tracker

Track and analyze income and expenses from multiple sources with automatic categorization, ROI calculation, and detailed reports.

This skill appears to be a simple local income/expense tracker that stores data in $HOME/.openclaw/workspace/data/income as newline-delimited JSON. Before installing: (1) inspect or vet the tracker.js file (you already have it) and ensure you are comfortable with data being stored unencrypted on disk; (2) make backups or set restrictive permissions on that directory if it will contain sensitive financial details; (3) be aware the CLI does minimal input validation so supplying missing/invalid flags can produce incorrect entries; and (4) run it in a controlled environment (or container) if you want to isolate its filesystem writes.

Type: OpenClaw Skill Name: multi-channel-income-tracker Version: 1.0.0 The skill bundle implements an income tracker as described. While there are no direct signs of malicious intent such as data exfiltration, unauthorized command execution, or persistence mechanisms, the `tracker.js` script exhibits a lack of input sanitization for command-line arguments like `--source`, `--category`, and `--description`. These values are directly stored in JSONL files and later printed to the console without validation or escaping beyond what `JSON.stringify` provides. This vulnerability could potentially be exploited if the stored data were processed by another component (e.g., a different skill, a web UI, or a shell script) that does not properly sanitize these inputs, leading to potential injection attacks (e.g., shell injection, XSS). The `SKILL.md` file is benign and does not contain prompt injection attempts.