Receipt Tracker

Распознает фотографии чеков, разбивает расходы по категориям (продукты, заправка, аптека, такси, животные и др.) и сохраняет их в базу (expenses.csv). Генери...

Do not install or enable this skill until you validate its origin and the purpose of nc_worker.py. Specific actions to consider: - Ask the author why a Nextcloud scanner and hard-coded credentials are included; require removal of any embedded secrets and moving credentials to environment variables if remote access is truly needed. - If you only want chat-uploaded receipts saved to local CSV, remove nc_worker.py before use or inspect/replace it with audited code that only performs the documented steps. - Treat the embedded Nextcloud credentials as sensitive: rotate/change them if they are real and were used elsewhere. - If you accept remote-Nextcloud functionality, insist on secure configuration (no hardcoded passwords, explicit requires.env entries, host allowlist) and an explanation of what files/folders the skill will access. - Because the skill can run exec/python per SKILL.md, audit any runtime behavior and avoid granting it access to sensitive system areas. If you are unsure, do not enable autonomous invocation until you have reviewed/modified the code.

Type: OpenClaw Skill Name: receipt-tracker Version: 1.1.0 The skill bundle contains hardcoded plaintext credentials (username and password) for a Nextcloud instance within the `nc_worker.py` file. While the core logic in `SKILL.md` for receipt tracking and OCR via Gemini appears benign and functional, the inclusion of static credentials and an internal network URL (http://fedora:8082) represents a significant security risk and poor practice, though no clear evidence of intentional data exfiltration or malicious behavior was identified.