Bank Statement Reconcile

Bank Statement Reconciler — Upload bank statements (CSV/Excel/PDF) + orders/invoices → AI auto-matching → Reconciliation results (matched/difference/unclaime...

Security Scan

The skill largely implements a legitimate reconciler, but there are multiple mismatches between its description/manifest and the actual code (undeclared env vars, unexpected external CLI usage, unclear AI usage and network calls) that merit caution before installing.

Purpose & Capability

The code implements bank statement parsing, matching, Excel export, Feishu card building, and per-call billing — which matches the stated purpose. However, the SKILL.md lists required environment variables (FEISHU_USER_ID, SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID, OPENAI_API_KEY) while the registry metadata shows no required env vars; that discrepancy is unexplained and should be reconciled.

Instruction Scope

Runtime instructions mention billing and transmitting user data to SkillPay (skillpay.me), which the code performs. The parser invokes an external CLI ('miaoda-studio-cli' via subprocess) to parse PDFs — this binary is neither listed as a required binary nor installed by the skill. SKILL.md requires an OPENAI_API_KEY for semantic matching, but the matcher code appears to use local heuristics (difflib/unicodedata); it's unclear if/where OpenAI is actually called. The skill will read files you supply (statements/orders) and may post billing info to an external endpoint.

Install Mechanism

This is an instruction-and-code-only skill with no install spec (lower disk/write risk), but the code expects runtime dependencies that are not declared: it calls an external CLI ('miaoda-studio-cli') via subprocess, and imports libraries such as requests and openpyxl. Those are not listed in the manifest and would need to be present on the host, creating hidden runtime requirements and potential supply-chain surprises.

Credentials

SKILL.md requires SKILL_BILLING_API_KEY and SKILL_BILLING_SKILL_ID for billing (proportionate to in-code SkillPay usage). However, FEISHU_USER_ID and OPENAI_API_KEY are listed as required despite the code not consistently reading FEISHU_USER_ID from env (the main entry accepts a user_id parameter) and the matcher appears to perform semantic matching locally (no explicit OpenAI calls visible). This mismatch makes it unclear why OPENAI_API_KEY would be mandatory and whether sensitive credentials would be transmitted to external services.

Persistence & Privilege

The skill is not always-enabled and does not request elevated system privileges or write persistent configuration beyond exporting Excel to a path (default /tmp). It does not modify other skills' configs. Autonomous invocation is allowed (platform default) but not combined with 'always: true', so no exceptional persistence privileges are requested.

What to consider before installing

Before installing, confirm the following with the skill author: (1) Which environment variables are actually required and why — the registry lists none but SKILL.md names FEISHU_USER_ID, SKILL_BILLING_API_KEY/SKILL_BILLING_SKILL_ID, and OPENAI_API_KEY. (2) Whether semantic matching uses an external AI service (OpenAI) or only local heuristics; do not provide your OpenAI key unless necessary. (3) That your data will be sent to https://skillpay.me if billing is enabled — review what user identifier and fields are transmitted. (4) The host must have 'miaoda-studio-cli' (PDF parser) and Python packages (requests, openpyxl, openpyxl dependencies); these are not declared in the manifest. If you plan to run this on sensitive data, consider running it in an isolated environment, examine/execute the code locally, and remove or sandbox network calls (billing/OpenAI) until you confirm their necessity and privacy behavior.

Bank Statement Reconciler

AI-powered bank statement reconciliation — upload statements + orders → get matched/difference/unclaimed/unmatched results.

AI Agent Full Flow

from scripts import reconcile_bank_statements, TierConfig

result = reconcile_bank_statements(
    statement_file="bank.csv",
    order_file="orders.csv",
    statement_type="auto",
    order_type="auto",
    match_mode="smart",
    amount_tolerance=0.01,
    date_range_days=3,
    tier=TierConfig(is_pro=True),
)

# Result keys: matched, differences, unclaimed, unmatched_orders, summary, excel_path

Supported Statement Formats

Chinese Banks (CSV/Excel/PDF)

Bank	Format	Key Columns
BOC	CSV/Excel	Transaction Date, Amount, Counterparty, Balance, Summary
ICBC	CSV/Excel	Date, Amount, Counterparty Name, Balance, Summary
CCB	CSV/Excel	Transaction Time, Amount, Counterparty, Balance, Remark
ABC	CSV/Excel	Transaction Date, Amount, Counterparty Name, Balance, Usage

Payment Platforms

Platform	Format	Key Columns
Alipay	CSV	Transaction Time, Counterparty, Amount, Status, Description
WeChat Pay	CSV	Transaction Time, Transaction Type, Amount, Counterparty, Remark
PayPal	CSV/JSON	Date, Amount, Item, Status, Counterparty
Stripe	CSV/JSON	Date, Amount, Description, Customer, Currency

E-commerce

Platform	Format	Key Columns
Amazon	CSV/Excel	Order Date, Order ID, Order Status, Item Total, Payment
Shopify	CSV/Excel	Created, Name, Financial Status, Total, Source
Temu	CSV	Date, Order ID, Amount, Status, Payment Method

Matching Modes

1. Exact Matching

Same date + same amount. Best for real-time payments, bank transfers.

2. Fuzzy Matching

Date within ±N days + amount within ±X tolerance. Best for delayed settlements, batch payments.

3. Semantic Matching (PRO only)

AI-powered counterparty name similarity matching. Handles: "Alibaba" ↔ "Alibaba Cloud", "Zhang San" ↔ "Zhang San (Personal)".

Tiered Features

Feature	FREE	PRO
Monthly statements	50	Unlimited
Bank accounts	1	Unlimited
Output format	Text	Excel + JSON
Alipay/WeChat	—	Yes
PayPal/Stripe	—	Yes
Semantic matching	—	Yes
Feishu card	—	Yes
Price	Free	$0.01/call

Excel Export Format

Exported Excel (reconciliation_YYYYMMDD_HHMMSS.xlsx) contains:

• Sheet: Matched — Matched transactions
• Sheet: Differences — Amount differences
• Sheet: Unclaimed — Money without order (unclaimed)
• Sheet: Unmatched — Order without payment (unmatched)
• Sheet: Summary — Summary statistics

Feishu Card Output

PRO tier supports Feishu interactive cards with match rate, amounts, and action buttons.

Billing

• Billing via skillpay.me/api/v1/billing/charge
• User data transmitted to SkillPay for billing identification
• $0.01 USD per reconciliation call (PRO tier)

Required Environment Variables

Variable	Description
FEISHU_USER_ID	User ID for billing
SKILL_BILLING_API_KEY	SkillPay Builder API Key
SKILL_BILLING_SKILL_ID	SkillPay Skill ID (default: bank-statement-reconcile)
OPENAI_API_KEY	AI model API key (for semantic matching in PRO)

Common Errors

Error	Cause	Solution
UNSUPPORTED_FORMAT	File format not supported	Convert to CSV/Excel
COLUMN_NOT_FOUND	Required column missing	Check statement format
AMOUNT_MISMATCH	Amount parsing failed	Verify currency/decimal
TIER_LIMIT_EXCEEDED	Statement count exceeds tier	Upgrade or split files