Valuation

This skill appears to be a simple, local logging utility for valuation workflows and does not request credentials or network access, but review the following before installing: - Data location and privacy: the tool writes logs to ~/.local/share/valuation (script hardcodes this path). Do not store secrets or sensitive financial documents as free-text entries because they will be persisted locally. - Docs vs. implementation mismatch: SKILL.md suggests you can override VALUATION_DIR via an environment variable, but the script ignores that variable. If you need a custom data location, update the script or move the directory after install. - Export sanitization: the export implementation writes raw entry values into JSON/CSV/TXT without escaping. Entries containing quotes, newlines, or CSV-special characters may produce malformed JSON/CSV or present CSV injection risks when opened in spreadsheet software. Avoid entering content that looks like formulas or contains untrusted data if you plan to open exports in other tools. - Minor bugs: exported JSON uses an echo with a literal "\n]" which may insert a literal backslash-n; exported JSON may therefore be malformed in some cases. Consider reviewing and testing exports before integrating with downstream tools. - Best practice: inspect the included script before use, consider changing the data directory or file permissions if you want to restrict access, and avoid logging secrets. If you need the VALUATION_DIR feature, either patch the script to read the environment variable or ask the maintainer for a corrected release.