Watch My Money

Analyze bank transactions, categorize spending, track monthly budgets, detect overspending and anomalies. Outputs interactive HTML report.

What to check before installing or using this skill: - Confirm where the actual parsing/CLI implementation lives. SKILL.md shows `python -m watch_my_money`, but the package contains no Python code or install instructions. Do not run commands you find in the docs unless you trust the executable they reference or have inspected its source. - Treat pasted CSVs/transaction text as highly sensitive. If you test, use redacted/synthetic data rather than real bank exports until you verify the code that will process them. - The skill will write files to ~/.watch_my_money/ (state.json and HTML/JSON reports). Review permissions on that folder and consider encrypting or restricting it if you store real data there. - The SKILL.md asserts “no network calls / local-only.” That is a behavior claim in prose, not an enforced guarantee — because this is an instruction-only skill with no code, you cannot audit runtime network behavior from this bundle. If you plan to run someone else’s implementation, audit that implementation for network calls. - If you want to use the CLI examples, obtain the actual Python package from a trusted source (e.g., the author’s official repo or a package index) and review its code. Alternatively, let the agent perform parsing strictly within the agent session and avoid running external binaries. - Consider backing up or securely deleting exported CSVs after analysis. If you install or run any code, verify it does not transmit data externally and inspect any third-party dependencies. If you need, I can: (a) point out exactly which lines reference the missing Python CLI, (b) recommend safe test data to try this workflow, or (c) draft a minimal local implementation (pseudo-code) that follows these instructions so you can run it with full visibility.

Type: OpenClaw Skill Name: watch-my-money Version: 1.0.0 The skill is designed for local financial analysis, explicitly stating 'privacy: local-only' and 'no network calls' for transaction data in SKILL.md. File system interactions are limited to saving state and reports in `~/.watch_my_money/`, which is a standard practice for local applications. The `assets/template.html` loads a font from Google Fonts, which is a benign network call for styling and does not involve data exfiltration or malicious execution. There is no evidence of prompt injection attempts against the agent, malicious execution, persistence mechanisms, or obfuscation.