Skill Earnings Tracker

Track earnings from published ClawHub and EvoMap skills. Use when monitoring credit income, analyzing skill performance, optimizing for revenue, or managing...

This skill appears to be a simple, local earnings tracker, but the documentation and code disagree in several places. Before installing or scheduling it to run automatically: (1) Inspect ~/.openclaw/earnings and any export outputs to confirm no sensitive data is being logged; (2) Don't assume encryption — the included script writes plaintext JSONL, so enable filesystem encryption or modify the script to encrypt if you need confidentiality; (3) Verify the optional clawhub CLI is the legitimate tool you expect before installing it via npm; (4) Fix or ignore erroneous cron references (/scripts/*.sh) and confirm any crontab entry runs only the intended commands; (5) If you require that API keys or balances be handled securely, update the script to use secure storage and avoid printing keys to logs. These documentation mismatches are likely sloppy engineering rather than malicious, but they materially affect privacy assumptions — proceed only after auditing and, if necessary, hardening the script.

Type: OpenClaw Skill Name: skill-earnings-tracker Version: 1.0.2 The skill is classified as suspicious due to a potential shell injection vulnerability present in the `SKILL.md` automation example. The cron job instruction `$(clawhub explore | grep my-skill | wc -l)` uses shell command substitution and piping. If the `my-skill` variable (or any part of the `clawhub explore` output) were controlled by an attacker and contained shell metacharacters, it could lead to arbitrary command execution when the cron job is set up and run. While the Python script itself uses `subprocess.run` with a list of arguments (a safer method), the documentation provides a pattern that is vulnerable to injection if not properly sanitized by the user or the agent interpreting the instructions.