Manage YNAB budgets, accounts, categories, and transactions.

v1.0.0

Manage YNAB budgets, accounts, categories, and transactions via CLI.

8· 2.4k·7 current·7 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (manage YNAB via CLI) legitimately requires a YNAB API key and a ynab CLI. However, the registry-level metadata you provided lists no required binaries, env vars, or install spec, while the SKILL.md (and its frontmatter) clearly request the 'ynab' binary and 'YNAB_API_KEY'. The omission in the registry metadata is an incoherence that needs explanation.
Instruction Scope
SKILL.md instructions stay within the expected scope: installing the ynab CLI, authenticating (YNAB_API_KEY or ynab auth login), and running standard budget/account/transaction commands. The instructions do not ask for unrelated system files or other credentials. 'ynab auth login' may open a browser or store tokens locally—expected for this workflow but worth noting.
!
Install Mechanism
The SKILL.md recommends installing @stephendolan/ynab-cli via 'npm i -g'. Installing a global npm package is a moderate-risk install step but appropriate for a CLI skill. The problem is the registry metadata reported 'No install spec' while SKILL.md includes an install block and an explicit npm install command — this inconsistency is concerning and should be reconciled. Before installing, verify the npm package source (owner, repo, recent releases).
Credentials
The only credential the instructions require is YNAB_API_KEY (appropriate for accessing YNAB). No unrelated secrets or many env vars are requested. The concern is that the registry metadata omitted this env requirement, so automated permission checks may not reflect the skill's true needs.
Persistence & Privilege
The skill does not request always:true or any elevated persistent presence. It is user-invocable and allows normal autonomous invocation (platform default). It does not request modification of other skills or system-wide settings.
What to consider before installing
What to consider before installing: - The SKILL.md expects you to install the ynab CLI (npm package @stephendolan/ynab-cli) and provide a YNAB_API_KEY. However, the registry metadata you were shown omitted those requirements — ask the publisher why, or prefer a skill whose declared requirements match its instructions. - Installing a global npm package runs third-party code on your system. Verify the package: check its npm page, GitHub repo, author, recent activity, and read the package source for anything unexpected before installing. - Only provide your real YNAB API key if you trust the package and environment. If possible, create a limited token or use a separate account for testing. - If you want to be cautious, run the npm package in a disposable environment (container/VM) and inspect what files it writes, whether it stores tokens locally, or whether it attempts network calls beyond the YNAB API. - If you plan to let an agent invoke this skill autonomously, remember that it could perform any CLI commands the installed ynab binary allows. Ensure the install and required env var are correctly declared in the registry or request clarification from the skill author before proceeding.

Like a lobster shell, security has layers — review code before you run it.

latestvk9763zt24mkwwa6we8drwvha1s7yn8mv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

💰 Clawdis
Binsynab
EnvYNAB_API_KEY
Primary envYNAB_API_KEY

Install

Install ynab-cli (npm)
Bins: ynab
npm i -g @stephendolan/ynab-cli

Comments