Spend Ledger

Tamper-evident payment ledger for autonomous agents — auto-detects payments across all tools, prevents duplicate payments, and presents full spending history.

This package appears to do what it says: it inspects tool calls/results, logs transactions to a local tamper-evident JSONL ledger, and offers a localhost dashboard. Before installing or enabling it, consider: 1) Network sync: by default it GETs patterns from https://api.spend-ledger.com daily and can POST opt-in pattern submissions that include a hashed install identifier; disable this by creating data/config.json with "sync_community_patterns": false if you want fully offline operation. 2) Local files: it creates data/transactions.jsonl and data/install-id.json (both written with 0600 mode). If you are concerned about fingerprinting, note the install-id UUID is stored locally and a SHA-256 is sent on opt-in submissions. 3) Hook privileges: the plugin inspects all tool calls and can block duplicate payments in-session — this is necessary for its function but means it has the ability to deny tool calls; review the code if you want stricter behavior. 4) Review the PATTERNS_URL env var if you want to point pattern sync to an internal mirror; otherwise it will use the public api.spend-ledger.com. If you need more assurance, you can audit server/server.js and transactions.js (not fully shown here) for any additional network calls or unexpected data leaks, run it in a restricted environment, or disable community sync and keep the dashboard offline (it binds to 127.0.0.1).

Type: OpenClaw Skill Name: spend-ledger Version: 0.4.0 The skill contains a code injection vulnerability in 'scripts/query-log.sh' and 'scripts/log-transaction.sh' due to unsafe string interpolation of shell variables into 'node -e' JavaScript commands. A maliciously crafted argument (e.g., a date or service name containing single quotes) could break out of the JS string literal and execute arbitrary code. While the skill implements several high-quality security features—including localhost-only binding, the absence of CORS headers to prevent cross-origin data theft, and automated query parameter stripping to protect API keys—the injection flaw remains a risk. The skill also performs daily outbound network requests to 'api.spend-ledger.com' to synchronize payment detection patterns.