Ksef Accountant En

• Analyzed: May 12, 2026, 3:40 AM
• Findings: 1
• Version: 2.2.6
• Hash: d272d60bd118b8f4bec10869f715c243200d8dccc15649d9b372773b3ea9ba3c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as benign. It explicitly declares itself as 'instruction-only' with `disableModelInvocation: true` and `has_executable_code: false` in both `SKILL.md` and `skill.json`. The content consists of domain knowledge, architectural patterns, and code examples (Python, XML, JSON) which are clearly stated as illustrative and not intended for execution by the agent. The skill goes to great lengths to educate the user on security best practices, platform-dependent enforcement, and warns against common vulnerabilities (e.g., never pasting credentials in conversation, avoiding `eval`/`exec`). All network calls in code examples are directed to legitimate KSeF or Polish government (VAT White List) APIs. There is no evidence of intentional harmful behavior, data exfiltration, persistence mechanisms, or prompt injection attempts against the agent; rather, the documentation actively promotes security awareness and mitigation.