← 返回 Skills 市场

DailyExpenseTracker

Name: DailyExpenseTracker
Author: gurpreetkaits

作者 Gurpreet Kait · GitHub ↗ · v1.0.1

cross-platform ⚠ suspicious

441

总下载

当前安装

版本数

在 OpenClaw 中安装

/install det

功能描述

DailyExpenseTracker API integration for recording expenses, checking balances, and managing transactions. Use when user mentions expenses, spending, transact...

使用说明 (SKILL.md)

DailyExpenseTracker (DET)

API

Base URL: https://dailyexpensetracker.in/api Token: Set in skills.entries.det.apiToken in openclaw.json Auth Header: Authorization: Bearer \x3Ctoken>

Wallets

Fetch wallets dynamically via /api/wallets endpoint. Cache wallet IDs locally after first fetch.

Add Expense

curl -X POST "https://dailyexpensetracker.in/api/transactions" \
  -H "Authorization: Bearer $DET_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "wallet_id": 1,
    "category_id": 5,
    "amount": 100,
    "type": "expense",
    "transaction_date": "2026-02-21",
    "description": "Groceries"
  }'

Required fields: wallet_id, amount, type, transaction_date Types: expense, income, transfer

Get Transactions

curl "https://dailyexpensetracker.in/api/transactions?per_page=10" \
  -H "Authorization: Bearer $DET_TOKEN"

Get Wallets with Balances

curl "https://dailyexpensetracker.in/api/wallets" \
  -H "Authorization: Bearer $DET_TOKEN"

Get Categories

curl "https://dailyexpensetracker.in/api/categories" \
  -H "Authorization: Bearer $DET_TOKEN"

Rules

ALWAYS use API - Never write directly to database
Field is transaction_date - Not date
Default wallet: HDFC BANK (1) unless specified
Confirm large amounts (>₹5000) before recording

安全使用建议

Before installing or enabling this skill, confirm where the API token will be stored and how it will be read (openclaw.json vs environment variable). Ask the author to: (1) declare required config paths or environment variables in the skill metadata, (2) clarify caching behavior (exact file/path, retention, and access permissions), and (3) provide guidance on token scoping (use a least-privilege token). Do not provide high-privilege credentials until you verify storage is secure and the token is limited to only the actions this skill needs (create/read transactions, list wallets). If you cannot get clear answers or the skill insists on storing secrets in an obvious plaintext location, treat it as untrusted.

功能分析

Type: OpenClaw Skill Name: det Version: 1.0.1 The OpenClaw skill bundle 'det' is designed for integrating with a DailyExpenseTracker API. All instructions and examples in SKILL.md describe standard API interactions (GET/POST requests to dailyexpensetracker.in) for managing expenses, requiring a user-configured API token. The 'Rules' section provides benign guidance for the AI agent, such as confirming large transactions. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints, arbitrary command execution, persistence mechanisms, or prompt injection attempts against the agent to subvert its purpose or access sensitive data.

能力评估

⚠ Purpose & Capability

Name and description match an expense-tracking integration and the SKILL.md contains reasonable API endpoints (transactions, wallets, categories). However, the SKILL.md expects an API token and refers to storing it under skills.entries.det.apiToken in openclaw.json, yet the skill metadata declares no required env vars or config paths. That mismatch (declared requirements: none vs instructions: require token/config) is an incoherence.

⚠ Instruction Scope

Instructions tell the agent to call the DET API with a Bearer token, cache wallet IDs locally after first fetch, and use a default wallet ID if unspecified. The doc also uses an environment variable ($DET_TOKEN) in curl examples while separately saying the token should be set in openclaw.json. The SKILL.md therefore references agent config, environment variables, and local caching without specifying where or how data is persisted or how secrets are read — granting broad discretion and creating ambiguity about what the agent will read/write at runtime.

✓ Install Mechanism

No install spec and no code files (instruction-only). That minimizes installation risk because nothing is downloaded or written by a provided installer. Risk arises from the runtime instructions rather than an install step.

⚠ Credentials

The skill clearly needs an API token to call the service, but the registry metadata lists no required env vars or config paths. The SKILL.md contradicts itself by referencing both skills.entries.det.apiToken (openclaw.json) and $DET_TOKEN. This inconsistency makes it unclear which credential is required and where it will be stored or read from — raising confidentiality and least-privilege concerns.

ℹ Persistence & Privilege

always:false (no forced persistence) which is appropriate. However, the instructions explicitly state 'Cache wallet IDs locally after first fetch' without specifying storage location, retention, or access controls. That implies the skill will persist data on the agent (or in its config) and should be clarified before use.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install det
安装完成后，直接呼叫该 Skill 的名称或使用 /det 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Fixed: removed hardcoded tokens, use config instead

v1.0.0

Initial release - API integration for expense tracking

元数据

Slug det

版本 1.0.1

许可证 —

累计安装 0

当前安装数 0

历史版本数 2

常见问题