Sure API

Use the we-promise/sure REST API with X-Api-Key auth. Covers accounts, transactions, categories, tags, merchants, imports, holdings, trades, valuations, chat...

This skill implements a legitimate-looking client for the Sure API, but there are actionable mismatches you should resolve before trusting it: - The skill reads SURE_API_KEY and SURE_BASE_URL from /root/.openclaw/workspace/secure/api-fillin.env (and will use that API key for any request). The registry metadata does not declare these required secrets or the config path — ask the publisher to add them to the metadata so you can make an informed decision. - The included low-level script (scripts/sure_api_request.sh) can call any API endpoint (including destructive ones like user delete/reset) using the stored API key. Prefer using the high-level CLI (which has --yes gates) and only run the raw request script when you understand the consequences. - The self-update script downloads the OpenAPI YAML from raw.githubusercontent.com and regenerates the local summary. If you or an automated agent runs that update, remote changes to the upstream spec could alter which endpoints the skill exposes; only run updates from a trusted network/source. - If you will allow autonomous invocation, consider the increased blast radius: an autonomous agent with access to the secure env file and permission to run the update or raw request script could issue arbitrary calls. If you are unsure, keep the skill user-invocable only and do not store the API key in a shared location. Suggested actions before installing: request updated metadata listing required env vars and config path; verify the secure env file is isolated and accessible only to the skill owner; prefer manual invocation for any write or update operations; and audit the OpenAPI file and allowed endpoints for any destructive actions you don’t want the agent to perform.