Sap Journal Auditor

Audits SAP FI/CO journal exports to detect duplicates, anomalies, cost center mismatches, approval bypass, intercompany issues, and unusual user activity.

This skill appears to do what it claims: it analyzes uploaded SAP journal CSV/XLSX files locally and returns an audit memo and a CSV of flagged lines. Before installing/running, consider: 1) provenance — registry metadata lists an owner ID but no homepage; the code includes author and RadarRoster links (verify you trust the source). 2) Data handling — the skill writes audit_memo.md and flagged_entries.csv to disk and sends them back via the agent; those files contain sensitive financial data, so run in an environment you control and delete outputs when done. 3) Memory retention — the agent memory stores a small run summary (timestamp, entriesCount, findings, overallRisk, period) for the last 20 runs; if that is a concern, clear or disable skill memory or avoid persistent storage. 4) Optional npm packages — the tool can use optional npm modules for enhanced Excel support; review package.json/package-lock.json before running npm install and prefer the built-in (zero-dependency) mode if you need stricter controls. 5) Safety practice — run the included test suite locally (node tests/test.js) and, if possible, execute the skill in an isolated/test environment first. Overall there are no red flags indicating unrelated credential access or network exfiltration in the provided files.

Type: OpenClaw Skill Name: sap-journal-auditor Version: 0.1.0 The SAP Journal Auditor skill bundle is a legitimate tool designed to analyze SAP FI/CO journal exports for financial anomalies. The code implements comprehensive audit logic for detecting duplicates, round-amount accruals, and approval bypass patterns across several files including index.js and lib/auditor.js. It features robust, zero-dependency CSV and XLSX parsers (lib/csv-parse-lite.js, lib/xlsx-lite.js) for restricted environments and generates professional audit reports. No evidence of data exfiltration, malicious execution, or prompt injection was found; the skill operates strictly on provided input files and uses local memory for run history.