Financial Goal Progress Tracker

Provides structured analysis, actionable recommendations, and next-step checklists to help track and manage progress toward financial goals.

Security Scan

The skill's code, instructions, and requirements are coherent with a descriptive financial-goal guidance tool; nothing requested is disproportionate or unrelated to its stated purpose.

Purpose & Capability

Name, description, skill.json metadata, and handler.py all implement a non-executable, analysis-oriented financial-goal guidance skill. The required environment/binaries/configs are none, which aligns with the described functionality.

Instruction Scope

SKILL.md repeatedly states 'No real code execution' and 'No external API calls', and the runtime instructions do not ask the agent to read unrelated files or secrets. However, the repository includes an executable handler.py and tests that run it; while harmless, this is a minor mismatch with the claim that no code will execute. The SKILL.md itself does not instruct the agent to run the code, so the mismatch appears to be informational rather than malicious.

Install Mechanism

No install spec is provided (instruction-only), so nothing is downloaded or written to disk by an installer. There are local code files but no external install actions. This is low risk.

Credentials

The skill declares no required environment variables, no credentials, and the handler.py does not access environment variables or external config paths. Requested access is proportionate to the stated purpose.

Persistence & Privilege

The skill does not request persistent presence (always:false) and does not modify other skills or system-wide settings. Autonomous invocation is allowed by default but is not combined with other risky requests.

Assessment

This skill appears coherent and benign: it analyzes plain-text user input and returns structured recommendations. A few practical notes before installing or enabling it: 1) Source is unknown (no homepage) — only include it if you trust the publisher or are comfortable inspecting the code; 2) The SKILL.md states 'no code execution', yet a runnable handler.py and tests are present — these are simple, local processing scripts (no networking) but you should inspect them or run tests in a sandbox if you have concerns; 3) The skill requests no secrets or system access, so it won't exfiltrate credentials as-is; 4) If you plan to let an autonomous agent invoke skills, remember autonomous invocation increases blast radius for any skill — this particular skill has low privilege, but only enable autonomous use if you trust installed skills overall. If you'd like, I can: summarize the handler.py behavior line-by-line, run a quick risk checklist, or produce a sandboxed test plan to validate it locally.

Overview

Tracks financial goal progress. This is a descriptive skill that provides frameworks and templates without executing real code.

Safety

• No real code execution
• No external API calls
• No financial transactions
• Informational only

Outputs

• Structured analysis
• Actionable recommendations
• Next steps checklist