momo

Momo namespace for Netsnek e.U. time tracking and invoicing tool for freelancers. Logs work hours, generates timesheets, creates invoices, and tracks payments.

This package appears to be a stub: it promises full time-tracking and invoicing features (PDF generation, payment tracking) but the only included script just echoes modes and does not store or send data. If you expected a working invoicing tool, do not rely on this release — ask the publisher for a full implementation or source for the invoice/reporting code. From a security standpoint the current contents are low-risk, but avoid giving it access to your real data until it actually implements storage, export, or external network calls. If you install or test it, run it in an isolated environment and inspect any future code updates for network calls, file writes, or credential usage before trusting it with client data.

Type: OpenClaw Skill Name: momo Version: 0.1.0 The skill requests `exec` permission in `claw.json` and `SKILL.md`, which is a high-risk capability. The `SKILL.md` demonstrates passing user-controlled arguments (e.g., project names, task descriptions) directly to the `./scripts/timesheet.sh` script. While the provided `timesheet.sh` script is incomplete and does not currently process these arguments, this design pattern represents a significant shell injection vulnerability risk if the script were fully implemented without robust input sanitization, potentially leading to arbitrary code execution.