安全扫描
OpenClaw
安全
high confidenceThe skill's files and runtime instructions are coherent with a local personal-finance tool: it parses statements, stores transactions under ~/.openclaw/workspace/finance, and uses jq/pypdf; it does not request credentials or call external endpoints.
评估建议
This skill appears internally consistent and stores data locally, but review before installing: 1) Ensure you trust the skill source since it will store sensitive financial data under ~/.openclaw/workspace/finance. 2) The scripts expect valid JSON input and rely on jq/pypdf—install those from your package manager. 3) There are minor implementation bugs (e.g., use of 'fabs' in jq output may error depending on your jq version); test on non-sensitive data first. 4) If Plaid or any network sync is l...详细分析 ▾
✓ 用途与能力
Name/content claim (parse statements, store/query transactions) matches the included scripts, SKILL.md, and README. Required tools (jq, pypdf) are appropriate for JSON manipulation and PDF text extraction. No unrelated credentials, binaries, or services are requested.
✓ 指令范围
Runtime instructions operate on local files under ~/.openclaw/workspace/finance and call only local scripts and pypdf; they instruct verification before import. There are no instructions to read system config outside the workspace or to transmit data to remote endpoints.
✓ 安装机制
No install spec (instruction-only) and included scripts are simple shell + jq; dependencies are standard (jq via apt/brew, pypdf via pip). No downloads from untrusted URLs or archive extraction.
✓ 凭证需求
The skill declares no environment variables or credentials and none are required by the scripts. Future Plaid integration is only mentioned as a roadmap item and is not implemented.
✓ 持久化与权限
always:false and user-invocable; the skill only writes to its own workspace (~/.openclaw/workspace/finance) and does not modify other skills or system-wide settings.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.22026/2/10
- Added `jq` as a required dependency for JSON transaction storage and querying. - Updated dependencies section in documentation to include installation instructions for `jq`.
● 无害
安装命令 点击复制
官方npx clawhub@latest install finance-skill
镜像加速npx clawhub@latest install finance-skill --registry https://cn.clawhub-mirror.com
技能文档
Personal finance memory layer. Parse statements, store transactions, query spending.
Data Location
- Transactions:
~/.openclaw/workspace/finance/transactions.json - Raw statements:
~/.openclaw/workspace/finance/statements/
Storage convention: OpenClaw workspace (~/.openclaw/workspace/) is the standard location for persistent user data. This matches where session-memory and other hooks store agent data. Credentials/config would go in ~/.config/finance/ if needed.
Tools
1. Parse Statement
When user shares a statement (image or PDF):⚠️ IMPORTANT: Telegram/channel previews truncate PDFs! Always extract with pypdf first to get ALL pages:
python3 -c "
import pypdf
reader = pypdf.PdfReader('/path/to/statement.pdf')
for i, page in enumerate(reader.pages):
print(f'=== PAGE {i+1} ===')
print(page.extract_text())
"
Then parse the full text output:
- Extract transactions from ALL pages
- Return JSON array:
[{date, merchant, amount, category}, ...] - Run
scripts/add-transactions.shto append to store - Verify total matches statement (sum of expenses should equal "Total purchases")
Extraction format:
Each transaction: {"date": "YYYY-MM-DD", "merchant": "name", "amount": -XX.XX, "category": "food|transport|shopping|bills|entertainment|health|travel|other"}
Negative = expense, positive = income/refund.
Categories:
- food: restaurants, groceries, coffee, fast food
- transport: Waymo, Uber, gas, public transit
- shopping: retail, online purchases
- bills: utilities, subscriptions
- entertainment: movies, concerts, theme parks
- health: pharmacy, doctors
- travel: hotels, flights
2. Query Transactions
User asks about spending → read transactions.json → filter/aggregate → answerExample queries:
- "How much did I spend last month?" → sum all negative amounts in date range
- "What did I spend on food?" → filter by category
- "Show my biggest expenses" → sort by amount
3. Add Manual Transaction
User says "I spent $X at Y" → append to transactions.jsonFile Format
{
"transactions": [
{
"id": "uuid",
"date": "2026-02-01",
"merchant": "Whole Foods",
"amount": -87.32,
"category": "food",
"source": "statement-2026-01.pdf",
"added": "2026-02-09T19:48:00Z"
}
],
"accounts": [
{
"id": "uuid",
"name": "Coinbase Card",
"type": "credit",
"lastUpdated": "2026-02-09T19:48:00Z"
}
]
}
Usage Flow
- User: shares statement image
- Agent: extracts transactions via vision, confirms count
- Agent: runs add script to store
- User: "how much did I spend on food?"
- Agent: reads store, filters, answers
Dependencies
jq— for JSON transaction storage and querying (apt install jq/brew install jq)pypdf— for full PDF text extraction (pip3 install pypdf)
Lessons Learned
- Telegram truncates PDF previews — always use pypdf to get all pages
- Verify totals — sum extracted expenses and compare to statement total before importing
- Coinbase Card — no Plaid support, statement upload only
Future: Plaid Integration
- Add
finance_connecttool for Plaid OAuth flow - Auto-sync transactions from connected banks
- Same query interface, different data source
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制