Morning (Green Invoice)

Use to authenticate with Morning (GreenInvoice) and create/manage clients, items, and accounting documents (invoice/receipt/quote/order/credit).

Security Scan

The skill's instructions match its stated purpose (interact with Morning/GreenInvoice using API keys) and it has no install footprint or broad privileges, but there are minor metadata/usability gaps you should review before use.

Purpose & Capability

Name/description and SKILL.md are consistent: the skill is an integration for Morning (GreenInvoice) to authenticate and create/manage clients, items, and accounting documents. All required actions and fields described align with that purpose.

Instruction Scope

Instructions are narrowly scoped to authentication and API operations (getToken, createClient, createItem, createDocument, etc.). They do not instruct the agent to read system files or unrelated credentials. Note: the SKILL.md expects the agent to collect apiKeyId and apiKeySecret from the user at runtime (and to use a 'morning' tool with action payloads) — there is no code here, so the agent will need a runtime backing tool or connector to actually perform API calls.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is written to disk and there are no external downloads to evaluate.

Credentials

The need for an API key ID and secret is proportionate to the stated functionality. However, the registry metadata declares no primary credential or required env vars while the SKILL.md explicitly requires apiKeyId/apiKeySecret. That mismatch can lead to the agent asking the user to paste secrets into chat instead of using a platform-managed secret field.

Persistence & Privilege

No always:true, no install persistence, and no requests to modify other skills or system-wide settings. Autonomous invocation is allowed but is the platform default and not combined with other concerning factors here.

Assessment

This skill appears coherent for GreenInvoice integration, but review before installing: (1) Confirm where and how you'll provide API credentials — prefer entering them into the platform's secure credential/secret store rather than pasting into chat. (2) Verify the runtime 'morning' tool/connector that will perform API calls exists and comes from a trusted source (the skill has no source/homepage listed). (3) Ask the publisher to declare a primary credential in the registry metadata so the platform can handle secrets securely. If you must paste credentials in chat, treat them as sensitive and rotate them after testing.

When to use

Use this skill when you need to interact with Morning / GreenInvoice to:

• Get an auth token (JWT) using API key credentials
• Create/update clients
• Create/update items
• Create documents (invoice / receipt / quote / order / credit / debit)
• Retrieve document outputs (e.g., IDs / links) if the tool supports it

What you need from the user

Collect only what’s required for the action:

Authentication

• apiKeyId
• apiKeySecret

Client (if creating or searching)

• name
• Optional: taxId, email, phone, address, city, country

Item (if creating)

• name
• price
• Optional: description, currency

Document (if creating)

• documentType (Invoice / Receipt / Quote / Order / CreditInvoice / DebitInvoice)
• clientId (or enough info to create the client)
• lines[] (each line: description or itemId, quantity, unitPrice)
• Optional: currency, language, description, discount

Tool contract

Use the morning tool with an action field.

Supported actions

• getToken
• createClient
• createItem
• createDocument
• (Optional, if implemented in your tool): findClient, findItem, getDocument, listDocuments

Guardrails

• Never log or echo apiKeySecret or JWTs back to the user.
• Prefer reusing existing clientId / itemId when available.
• Validate document lines:
  • quantity > 0
  • unitPrice >= 0
• Currency: default to "ILS" unless the user specifies otherwise.
• Language: default to "Hebrew" unless the user specifies otherwise.

Examples

1) Authenticate (JWT)

{
  "action": "getToken",
  "apiKeyId": "YOUR_API_KEY_ID",
  "apiKeySecret": "YOUR_API_KEY_SECRET"
}

2) Create a client

{
  "action": "createClient",
  "jwt": "JWT_FROM_getToken",
  "client": {
    "name": "Acme Ltd",
    "taxId": "515555555",
    "email": "[e-mail]",
    "phone": "[phone]",
    "address": "1 Rothschild Blvd",
    "city": "Tel Aviv",
    "country": "Israel"
  }
}

3) Create an item

{
  "action": "createItem",
  "jwt": "JWT_FROM_getToken",
  "item": {
    "name": "Consulting hour",
    "description": "Senior engineering consulting",
    "price": 500,
    "currency": "ILS"
  }
}

4) Create a document (Invoice)

{
  "action": "createDocument",
  "jwt": "JWT_FROM_getToken",
  "document": {
    "documentType": "Invoice",
    "language": "English",
    "currency": "ILS",
    "clientId": "CLIENT_ID",
    "description": "Invoice for January services",
    "lines": [
      {
        "description": "Consulting hour",
        "quantity": 10,
        "unitPrice": 500
      }
    ]
  }
}

5) Create a document (Receipt) using itemId

{
  "action": "createDocument",
  "jwt": "JWT_FROM_getToken",
  "document": {
    "documentType": "Receipt",
    "language": "Hebrew",
    "currency": "ILS",
    "clientId": "CLIENT_ID",
    "lines": [
      {
        "itemId": "ITEM_ID",
        "quantity": 1,
        "unitPrice": 1200
      }
    ]
  }
}

Error handling

• If token is rejected (401/403): call getToken again and retry the request once.
• If client/item already exists:
  • Prefer returning the existing ID (if tool supports lookup),
  • Otherwise surface a clear message: “Client already exists; provide clientId or unique identifier.”
• If validation fails: ask for the missing/invalid fields only (e.g., “quantity must be > 0”).

Output expectations

Return minimally:

• Created resource IDs (clientId, itemId, documentId)
• Any relevant URLs (PDF / view links) if the API/tool provides them