Clawhub Skill Passive Income Tracker

Track earnings, payouts, and uptime from multiple passive crypto income apps with daily summaries and export options in USD/EUR.

This skill conceptually fits its purpose (aggregating earnings) but the package is instruction-only and does not include the CLI or code that it references. Before installing or running anything you should: 1) Inspect the referenced GitHub repository code yourself (or ask for it) to verify how tokens are stored/encrypted and how alerts (WhatsApp/Telegram) are delivered. 2) Avoid pasting long-lived secrets or passwords on the command line; prefer short-lived API keys or read-only tokens and use a secure secret entry method. 3) Verify the repository's authenticity (owner, commits, issues) and prefer running the code on an isolated machine or VM. 4) If you proceed, confirm exactly where credentials are saved and how encryption is implemented; do not rely solely on the SKILL.md claim of 'encrypted at rest'. 5) Consider whether automatic messaging requires additional credentials and where those will be stored.

Type: OpenClaw Skill Name: passive-income-tracker Version: 1.0.0 The skill is classified as suspicious primarily due to its reliance on the `exec` tool, which, without reviewing the underlying Python code, presents a significant vulnerability risk for shell injection or unauthorized command execution. While the `SKILL.md` explicitly states 'No telemetry, no cloud sync' and 'API tokens stored encrypted at rest' (mitigating exfiltration concerns), the handling of sensitive API tokens and local node keys, combined with the powerful `exec` capability, warrants caution. There is no evidence of prompt injection attempts or intentional malicious behavior like data exfiltration to external, unauthorized endpoints.