Ksef Accountant En
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent instruction-only KSeF accounting reference, but it discusses optional tax-system credentials and legally binding invoice workflows that users should handle carefully.
This skill looks reasonable as an instruction-only KSeF accounting reference. Before installing, treat it as sensitive because KSeF tokens and production invoice workflows can affect real tax records. Use demo mode for testing, avoid giving credentials unless the platform marks them as protected secrets, and require human review before any production invoice, payment, or VAT-related action.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If these workflows are used with real production credentials, mistakes could create legally binding invoices or compliance issues.
The skill documents high-impact KSeF API actions, including sending invoices that may be legally binding in production. This fits the accounting purpose and includes warnings, but users should ensure any real API use remains explicit and reviewed.
POST /api/online/Invoice/Send ... Authorization: SessionToken {token} ... PRODUCTION ... Data: Legally binding ... WARNING: Do NOT test on production!Use the demo environment for testing, require explicit user confirmation before production actions, and have accounting or tax staff review invoice submissions.
Providing a KSeF token could allow authenticated access to invoice data or invoice submission workflows if used by the surrounding agent/platform.
The skill declares optional credentials for KSeF authentication and token handling. These credentials are purpose-aligned, but they can grant access to sensitive tax/invoice functions and should only be configured if the platform protects secrets correctly.
KSEF_TOKEN: description: "KSeF API token for session authentication. Provided by the user ..." ... KSEF_ENCRYPTION_KEY ... secret: true
Do not paste credentials into chat; only use platform-managed secrets, confirm they are isolated and hidden from logs, and limit token permissions to the minimum needed.