Agentfinobs

This skill appears to be what it claims (an on-agent financial observability SDK), but review the following before installing or enabling it: - Network exposure: the Dashboard (and Prometheus exporter) start HTTP servers and the Dashboard example binds to 0.0.0.0 by default. If you run this on a machine with network access, lock it down (bind to localhost, use a firewall, or put behind authenticated proxy). - Data exfiltration: WebhookExporter will POST every transaction to the configured URL. Only configure trusted endpoints and avoid embedding sensitive API keys in code or in public repos. Prefer the Console or local Jsonl exporters for testing. - Local persistence: transactions are written to JSONL on disk by default. Ensure the persist path is acceptable, has correct permissions, and does not leak to backups or shared volumes. - Dependency/runtime: Prometheus and httpx are optional and imported at runtime; installing optional extras will add those dependencies. Review the package on PyPI or its source repository before pip installing, especially since the skill owner/source are not provided in the metadata. - Least privilege and isolation: run the tool in an isolated environment (container, VM, or sandbox) until you confirm configuration and network exposure are safe. If you want a tighter posture, ask the maintainer (or inspect the SpendTracker/tracker implementation in full) for the defaults used for persistence paths, dashboard host binding, and any automatic exporter defaults; change them to local-only, authenticated, or disabled as appropriate.