My finance agent
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill claims Google Drive sync and requires a GDRIVE_CREDENTIALS environment variable, but the included code does not read or use those credentials (mismatch between stated purpose and implementation).
This skill claims to sync CSV data to Google Drive and asks for GDRIVE_CREDENTIALS, but the shipped code does not read or use those credentials. Before installing or granting Drive access: (1) inspect/confirm the code that will actually perform any Drive uploads (none exists here), (2) if you need Drive sync, ask the author to implement it or provide a trustworthy implementation that explicitly uses the credential and limits scope, (3) if you decide to run it, use least-privilege credentials (e.g., a service account limited to a specific folder) and run in a sandbox, and (4) consider removing the GDRIVE_CREDENTIALS requirement or disabling it until Drive integration is implemented. If you don't trust the source, do not provide your Google credentials.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.