Snarky Expense Butler

毒舌记账管家，支持记账、查询、预算提醒、毒舌消费分析、地域统计、趋势图。当用户提到记账、消费、花销、支出、记一笔、消费分析、预算、记个账时触发。NOT for: 股票/投资分析、记账软件推荐。

This package appears to be a straightforward local expense tracker. Key points to consider before installing/using: - Data storage: Your expenses are stored in a local JSON file (default: scripts/expense_records.json). Backups and file permissions are recommended because the scripts will read/write and can modify historical records (e.g., backfill). - Optional network use: expense_trends.py will attempt to call openrouter.ai if you set OPENROUTER_API_KEY in your environment. That call would send the chart data (labels and amounts) to the external service to request an image. If you do not set that API key, the code falls back to local matplotlib. Only set an API key if you trust the external service and are comfortable sending this data. - Config file read: the trends script tries to read ~/.openclaw/openclaw.json as a convenience; it does not appear to exfiltrate keys or attempt to access system keychains. - Inspect/lock the data file: Because the tool writes plain JSON, anyone with filesystem access to that path can read your financial data. Consider using filesystem permissions or placing the file in a secure location and setting EXPENSE_DATA_FILE/EXPENSE_TRENDS_DIR accordingly. - Autonomy: The skill can be invoked by the agent (default platform behavior) but it does not autonomously send data unless you provide an external API key and run the trends command. If these behaviors match your expectations, the skill is coherent with its description. If you are uncomfortable with potential network calls, avoid setting OPENROUTER_API_KEY or audit/modify expense_trends.py to remove the remote call.

Type: OpenClaw Skill Name: snarky-expense-butler Version: 1.0.0 The skill bundle exhibits a significant discrepancy between its documentation and its actual code behavior. While SKILL.md claims the system is 'purely local' with 'no external dependencies' and 'no API Key required,' the script 'scripts/expense_trends.py' actively attempts to locate OpenRouter API keys within the user's home directory (~/.openclaw/openclaw.json) and contains logic to exfiltrate expense data to an external endpoint (openrouter.ai). This deceptive behavior regarding data privacy and credential access warrants a suspicious classification.