Expense Tracker

Just say what you spent — your AI logs it, categorizes it, and tracks it against your budget. No apps, no forms, no friction. Supports natural language like...

This skill appears to do what it says: it logs and reports expenses locally using the included bash scripts. Before installing: 1) Ensure jq (and bc if you want exact bc-based numeric outputs) is installed on the host — the skill metadata does not declare these dependencies even though the scripts require them. 2) Review the included scripts (add-expense.sh, query.sh, budget-check.sh) yourself — they run locally and write to expenses/ledger.json as plain JSON (no encryption). If your ledger contains sensitive notes, consider file permissions or storing the folder on encrypted storage. 3) Note minor inconsistencies: SKILL.md header version (1.0.2) vs registry version (1.0.3) and unknown source/homepage — if provenance matters, ask the publisher for a canonical source or signed release. 4) Because the agent can invoke skills autonomously (platform default), decide whether you want to allow autonomous operations that may append to ledger.json; if not, restrict invocation. Overall this is coherent for a local expense tracker but check dependencies and storage/permissions before use.

Type: OpenClaw Skill Name: nicholasrae-expense-tracker Version: 1.0.3 The OpenClaw AgentSkills skill bundle for expense tracking is classified as benign. All shell scripts (`add-expense.sh`, `budget-check.sh`, `query.sh`) correctly utilize `jq --arg` and `jq --argjson` to pass user-controlled input as data, effectively preventing `jq` injection vulnerabilities. Input validation for dates and amounts is also implemented. The `SKILL.md` instructions explicitly guide the AI agent to use these secure `jq` methods. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. All file operations are local and confined to the skill's directory.