Is aholake/expense-tracker safe?
https://github.com/openclaw/skills/tree/main/skills/aholake/expense-tracker
The aholake/expense-tracker skill is a clean, narrow-scope local expense logging tool. Its Python script uses only standard library modules, performs no network calls, reads no sensitive files, and writes only to a documented local workspace path. The monitoring anomaly — honeypot files being read — is temporally and contextually attributable to the audit framework's own pre/post-install canary verification scans, not to any code in the skill; canary integrity is confirmed intact. No prompt injection, git hooks, npm scripts, submodules, or exfiltration behaviors were detected.
Category Scores
Findings (5)
MEDIUM Honeypot Credential Files Read During Monitoring Window -20 ▶
Six honeypot files were read-accessed during the monitoring period. The first batch (10:10:44, audit serial 267-272) precedes the git clone by six seconds and is attributable to the monitoring framework's pre-install canary baseline scan. A second batch (~10:11:08, audit serial 1444-1449) follows installation completion but coincides with the monitoring system actively executing find and cat commands against the skill directory (audit serial 1223-1234 region). The Python script contains no code path that would access any of these file locations. Canary integrity is confirmed intact.
LOW Executable Python Script Bundled With Skill -12 ▶
The skill ships a Python script that the SKILL.md instructs the agent to invoke directly via python3. The script is clean — stdlib-only, no network, no subprocess, no dynamic execution — but its presence means the agent will execute code on the user's machine as a normal part of skill operation. This is expected for this skill type but warrants noting.
LOW Script Writes Data Outside Skill Directory to User Home 0 ▶
The expense logging script defaults the workspace to ~/.openclaw/workspace and creates expense files there. This is a documented, intentional design choice for workspace-integrated tools, and the directory is a known openclaw convention, but it means the skill will create and modify files in the user's home directory outside any sandboxed skill path.
INFO No Prompt Injection Patterns Detected in SKILL.md 0 ▶
Full text of SKILL.md reviewed. Contains only legitimate, clearly-purposed instructions: bash command templates for log_expense.py with documented flags, workflow examples, and financial goal guidance. No hidden content, no instruction overrides, no URL fetches, no persona manipulation.
INFO Installation Confined to Expected Paths and Endpoints 0 ▶
The git sparse-checkout cloned only the target skill subdirectory from the openclaw/skills monorepo on GitHub. Post-install connection diff shows no new listening services or persistent outbound connections. The temporary clone directory was cleaned up with rm -rf as expected.