Kubera

Read and manage Kubera.com portfolio data (net worth, assets, debts, allocation, holdings). Use when a user asks about their finances, net worth, portfolio, investments, holdings, asset allocation, or wants to update asset values in Kubera. Works with any AI agent or CLI that can run Python scripts.

Security Scan

The skill's code and instructions appear to implement a legitimate Kubera API client, but the registry metadata fails to declare the API credentials the skill requires (KUBERA_API_KEY and KUBERA_SECRET), which is an incoherence that warrants caution.

Purpose & Capability

Name/description, SKILL.md, references/api.md, and scripts/kubera.py consistently implement a Kubera API client (read and update portfolio data). However the registry metadata claims no required environment variables or primary credential even though both the README and the script require an API key and secret. That mismatch is unexpected and reduces trust in packaging/metadata.

Instruction Scope

Runtime instructions (SKILL.md) are narrowly scoped to interacting with the Kubera API: set KUBERA_API_KEY/KUBERA_SECRET and run the provided Python script with the listed subcommands. The code only reads those credentials (or CLI args), calls api.kubera.com endpoints, and prints results; it does not attempt to read unrelated system files, other environment variables, or post data to other hosts.

Install Mechanism

There is no install spec (instruction-only skill with an included Python script). The script uses only Python standard library modules (urllib, hmac, hashlib, etc.), so no additional package installs are required. This is low-risk from an installer perspective.

Credentials

The skill requires KUBERA_API_KEY and KUBERA_SECRET (SKILL.md and scripts/kubera.py) but the registry metadata lists no required env vars and no primary credential. Requiring two sensitive credentials is proportionate to the purpose, but failing to declare them in metadata is an inconsistency that could lead to accidental credential exposure or misconfiguration. Also the script accepts credentials via CLI args, which can expose secrets in process lists or logs if used improperly.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by default (disable-model-invocation=false), which is normal for skills; this combined with the credential mismatch is why caution is advised, but the skill does not request unusual persistence.

What to consider before installing

This package appears to be an on-purpose Kubera API client (it signs requests and talks only to api.kubera.com). However: 1) The registry metadata did not declare the two sensitive environment variables the script actually needs (KUBERA_API_KEY and KUBERA_SECRET) — that discrepancy is suspicious and may indicate sloppy packaging or omission. 2) Only install/use this skill if you trust the source; there is no homepage and the owner is an ID string. 3) If you proceed, create a read-only Kubera API key when possible, avoid passing secrets on the command line (prefer env vars), and run the script in an isolated environment. 4) Review the full scripts/kubera.py file locally (it is included) to confirm there are no hidden network calls or modifications beyond the Kubera API before providing credentials. 5) If you want higher assurance, ask the publisher to correct the registry metadata to list required env vars and provide a verifiable homepage or source repository.

Query and update portfolio data via the Kubera API.

Setup

Set environment variables:

export KUBERA_API_KEY="your-api-key"
export KUBERA_SECRET="your-api-secret"

Generate keys at Kubera Settings > API. Read-only is recommended unless updates are needed.

Usage

Run scripts/kubera.py with a subcommand:

# List portfolios
python3 scripts/kubera.py portfolios

# Net worth summary with allocation + top holdings
python3 scripts/kubera.py summary

# Full portfolio JSON (for detailed analysis)
python3 scripts/kubera.py json

# List assets, optionally filter by sheet or sort
python3 scripts/kubera.py assets --sheet Crypto --sort value

# Search assets by name/ticker/account
python3 scripts/kubera.py search "shopify"

# Update an asset (requires write permission + --confirm flag)
python3 scripts/kubera.py update <ITEM_ID> --value 5000 --confirm

Use --json on summary, assets, search, or portfolios for machine-readable output. Use json subcommand for the complete raw API response.

For multi-portfolio accounts, pass --portfolio <ID>. Single-portfolio accounts auto-select.

Rate Limits

• 30 req/min, 100/day (Essentials) or 1,000/day (Black)
• Cache json output when running multiple queries in a session

API Details

See references/api.md for authentication, endpoints, and object schemas.