Openclaw Receipt Manager

Manage personal receipts by extracting data from images, storing records, and providing expense searches and monthly financial summaries.

This skill appears to do what it says: it stores receipts locally in data/receipts and uses a local SQLite DB. Before installing, consider: (1) Verify the skill source (README suggests a GitHub repo — confirm you trust it). (2) The skill will read any image file path you provide that lives under your home directory and copy it into the skill's images folder — avoid passing paths to sensitive files. (3) If tesseract is installed, the skill will call it locally for OCR; tesseract is invoked via subprocess but no network calls are made by the skill code. (4) Inspect the full receipt_db.py CLI portion (the file was partially shown) if you want to be extra cautious; based on the reviewed code there are reasonable sanitization and path checks. (5) Run the tool in a limited environment or with test data first if you have concerns about accidental leakage of sensitive files.

Type: OpenClaw Skill Name: openclaw-receipt-manager Version: 0.1.7 The OpenClaw Receipt Manager skill is classified as benign. The Python scripts (`scripts/handler.py` and `scripts/receipt_db.py`) demonstrate robust security practices, including explicit input sanitization (`sanitize_string`, `validate_path`), safe execution of external commands via `subprocess.run` with argument lists (preventing shell injection), and parameterized SQL queries (preventing SQL injection). Crucially, `scripts/receipt_db.py` includes strong path validation and restricts image file operations to the user's home directory, preventing path traversal and unauthorized file access. No evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation was found. The skill's functionality is entirely aligned with its stated purpose of local receipt management.