Security audit
Security checks for vulnerabilities and agentic risk
The skill supports month-end bookkeeping with explicit approvals for changes, although some scope wording is inconsistent.
Expect access to sensitive ledger and statement data. Review proposed entries, staged files, and the financial report included in the commit message. If you require strictly local processing, explicitly disallow the hosted-server handoff.
The command add close --date "$close_date" --account "$account" performs account closure rather than period-end reconciliation and reporting. This directly contradicts the description's explicit instruction to skip single-account close directives.
The command add open changes the ledger's account lifecycle by opening an account, a capability not described in the period-close workflow. This is materially different from reconciling active accounts and reviewing period reports. The --allow-errors option also permits this operation despite errors, although this chunk does not show a commit or establish that the required pre-commit check is bypassed.
The command explicitly performs an import with --apply and --no-input, introducing ledger-changing transaction ingestion that the description does not disclose. Although importing transactions could precede reconciliation, it is a substantive capability beyond the described close workflow, not merely a supporting check. The chunk provides no evidence of pushing, committing, or accessing hosted ledgers.
The supplied command invokes add open, which records the opening of an account rather than reconciling accounts or validating a period close. Account creation is a distinct accounting operation, not an evident supporting implementation detail of the declared workflow. This assessment is limited to the supplied code chunk.
The supplied command performs data ingestion rather than reconciliation or period-close validation. Importing transactions is a distinct ledger-modifying operation, not merely an implementation detail of the declared checks and reporting. The chunk does not establish whether the ledger is hosted, so no hosted-ledger violation is inferred.
The supplied command performs a ledger-writing transaction import (add transactions --from ... --into ...). The declared purpose does not describe batch transaction ingestion, and the chunk does not establish that this operation supports the specified reconciliation workflow. It contains no period-close validation or commit behavior. The command alone does not establish whether the ledger is locally stored or hosted.
The supplied command records a commodity price rather than performing reconciliation, validation, flag review, reporting, or commit preparation. Price maintenance can relate to period-end accounting, but this description does not disclose adding or updating prices, and the supplied chunk does not establish that this write is a supporting step of the declared workflow.
The supplied command performs transaction entry, with trade-link, option-posting, and income-account parameters. It does not show a connection to reconciliation adjustments or other period-close work that would make this a supporting implementation detail. No reconciliation, validation, flag review, reporting, or commit proposal is present in this chunk. This assessment is limited to the supplied command; it does not establish what checks may exist elsewhere.
The manifest limits this skill to local ledgers and explicitly says to skip ledgers hosted on Beancount.io. These instructions instead direct the agent to use the connected hosted server's tools and specifically map beancount-close to its close-month prompt, extending the workflow to an excluded remote environment.
L048 explicitly states that this skill does not create entries to fill a gap, while L082–L085 instruct it to compose an entry for a missing recurring charge and write it through the shared transaction recipe. The separate confirmation gate limits unintended writes, but does not resolve the contradiction with the documented scope.
No suspicious patterns detected.
