Skills/ClawHub/friday-budgeting-pro

friday-budgeting-pro@1.0.7

CAUTION· install only

Publisher claims: "AI-powered personal finance tracker. Connects to your banks via Plaid, auto-classifies transactions, syncs daily, and exports to Excel. Supports multiple led..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher riddy21 · publishing for 172 daysInstalls 911Last detonated 22 min ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-14 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 2 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.4sfilesystemread ~/.friday-bp outside project
0.4sfilesystemwrote ~/.friday-bp/data.db · ~/.friday-bp/data.db-journal · ~/Library/LaunchAgents/ai.openclaw.friday-budgeting-pro.plist
0.4sprocessexec /usr/bin/dirname
0.4sprocessexec /usr/bin/mkdir
0.4sprocessexited 1: ./scripts/install.sh: line 26: /tmp/ks-detonate-NAAr3X/setup/home/Library/LaunchAgents/ai.openclaw.friday-budgeting-pro.plist: No such file or directory
0.4sprocessscript backend runs setup only
0.4sprocessscript backend runs setup only
0.6sprocesssecond launch, clock +45 days, CI unset
0.7sfilesystemwrote ~/.friday-bp/data.db · ~/Library/LaunchAgents/ai.openclaw.friday-budgeting-pro.plist
0.7sprocessexec /usr/bin/dirname
0.7sprocessexec /usr/bin/mkdir
0.7sprocessexited 1: ./scripts/install.sh: line 26: /tmp/ks-detonate-NAAr3X/later/home/Library/LaunchAgents/ai.openclaw.friday-budgeting-pro.plist: No such file or directory

Static findings

HIGH
Access to sensitive file pathsserver/main.py:2670 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# gracefully to the .env write below. Production runs always have anFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver/main.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Project root — tests monkeypatch this to a tmp dir so .env writes stay isolated.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedserver/installer.py:119 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/install.sh:29 · File permission modification command — agent changes file ownership/permissionschmod 0644 "$PLIST_DEST"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsserver/daemon.py:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"falling back to .env / environment variables. Detail: %s",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver/main.py:2634 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Write Plaid credentials to .env and update the running process environment.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_dotenv.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert (REPO_ROOT / ".env.example").exists(), ".env.example not found at repo root"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_lint_security.py:14 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_paths.py:58 · File permission modification command — agent changes file ownership/permissions# Pre-create the directory, then force the wrong mode with chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsserver/main.py:2646 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesThe .env file is written atomically (temp file + os.replace) with modeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_configure_plaid.py:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescontent = (tmp_path / ".env").read_text()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_dotenv.py:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestests/test_dotenv.py — Verify .env.example, .gitignore rules, and daemon load_dotenv integration.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver/daemon.py:177 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(Path(__file__).parent.parent / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsui/server.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env before any server imports so Plaid credentials are availableFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedserver/installer.py:139 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedserver/notify.py:84 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_dotenv.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env.exampleFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_isolation_safety.py:32 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_isolation_safety.py:66 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsserver/daemon.py:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesDB values take precedence over whatever .env already loaded — theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/batch_classify.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env before importsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver/main.py:2647 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files0o600. If .env already exists it is fully replaced, not appended.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_configure_plaid.py:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver/daemon.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescode) picks up the authoritative per-user credentials even if ``.env``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_configure_plaid.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Redirect all .env writes to tmp_path so tests never touch the real repo."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsui/server.py:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_load_dotenv(_pathlib.Path(__file__).parent.parent / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_configure_plaid.py:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_configure_plaid.py:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver/daemon.py:171 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 0. Load .env from project root (no-op if file doesn't exist).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/batch_classify.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(Path(__file__).parent.parent / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_dotenv.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Ensure .env.example is committed at the project root."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/ui/conftest.py:139 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_paths.py:59 · File permission modification command — agent changes file ownership/permissions# (mkdir respects umask, so chmod is required to set an exact mode).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_skill_md_sync.py:20 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_paths.py:158 · File permission modification command — agent changes file ownership/permissions# (mkdir respects umask, so chmod is required to set an exact mode).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtests/test_paths.py:157 · File permission modification command — agent changes file ownership/permissions# Pre-create the directory, then force the wrong mode with chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈3,356 tok
1 file · 156 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim riddy21: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim riddy21Propose a patch to the maintainer