Automates payments, invoices, expenses, and financial reports with Stripe webhooks and real-time Telegram notifications for streamlined finance management.

This repository implements the finance automation functionality it advertises, but the registry metadata is incomplete: it declares no required environment variables even though the code and docs require many secrets (Stripe, Lemon Squeezy, Telegram, SMTP, JWT secret, OpenClaw token, DB URL). Before installing or running: - Treat this as running a networked service that will handle real payments and sensitive data. Run it in an isolated/staging environment, not directly on production systems. - Do NOT paste or reuse production API keys until you have audited the notification and webhook code (src/services/notification.js and src/webhooks/*). Verify where notifications and outgoing requests are sent. - Provide explicit environment variables (STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, SMTP_* , JWT_SECRET, OPENCLAW_TOKEN, DATABASE_URL) only after you confirm you trust the code and repository source. The registry metadata should have listed these — its omission is a red flag. - Replace the default JWT secret (change-this-secret) with a strong secret before exposing the API. Confirm proper rate limits, CORS, and HTTPS are configured for production. - Review logging/storage behavior (logs/, storage/pdfs, storage/receipts) to ensure no sensitive keys or full payment data are being written to insecure locations or committed to source control; add .env to .gitignore. - Optionally run the service in a container or with a restricted user, monitor outbound network requests, and perform a quick code review of notification/webhook modules for any unexpected external endpoints. If you need a safer quick test, use Stripe test keys and a throwaway Telegram bot/token and run locally behind a tunneling tool (ngrok) in a sandbox environment.

Type: OpenClaw Skill Name: finance-automation Version: 0.2.1 The skill bundle is largely benign, implementing finance automation features. However, the `sendOpenClaw` function in `src/services/notification.js` is designed to send messages to the OpenClaw API. While currently unused in the provided code, if activated and fed user-controlled input, this function could be vulnerable to prompt injection against the OpenClaw agent. This represents a risky capability without clear malicious intent, classifying it as suspicious.