Security audit
Security checks for vulnerabilities and agentic risk
The local import workflow has strong safeguards, but conflicting instructions extend it to hosted financial tools without clearly defining the approval boundaries.
Use a backed-up local ledger and approve the exact entries and destination before writing. Clarify the hosted-ledger scope and approval requirements before allowing connected server operations. Provide a SimpleFIN access URL only when intentionally enabling that financial-data feed, and keep it out of committed files.
The supplied command performs a price-refresh operation, not an export import or any of the described transaction-review steps. Price maintenance is a distinct capability not declared in the description, and the supplied chunk does not establish it as a supporting step for an import.
The command bea ... add close performs account-lifecycle management, which is not described as an import capability or a necessary supporting step. Although it uses the declared local-ledger tool, its operation is materially different from importing financial exports. The snippet also provides no evidence of the declared review and confirmation workflow, though confirmation could occur elsewhere.
The command's operation is add price, which records market-price data rather than imported financial activity. The description does not declare price maintenance, and the supplied chunk shows no connection establishing it as a supporting step in an import. Using bea and a local ledger is consistent with the description, but the write operation itself is outside the stated purpose.
The supplied command invokes price status, a price-information query not described in the declared import workflow. Although it uses the expected ledger and CLI, the chunk contains no import behavior or clear connection to a required import check. No write or external data transfer is shown.
The manifest at L003 limits imports to existing local ledgers and explicitly says to skip ledgers hosted on Beancount.io. L084 instead instructs the agent to use the connected hosted server's categorize-imports prompt and tools, providing an operational hosted-import path rather than stopping at the declared local-only boundary.
The manifest limits this skill to existing local ledgers and explicitly says to skip ledgers hosted on Beancount.io. In contrast, L019–L028 instruct the agent to use the hosted server's tools and specifically map beancount-import to the categorize-imports prompt; L031–L034 also offer connecting that server as a way forward. This expands the workflow into a remote-ledger environment that the manifest excludes.
The manifest scopes brokerage support to activity CSVs imported as lot-carrying entries. This section instead accepts holdings or cost-basis snapshots and creates opening transactions, seeding securities and cash against opening equity; initializing portfolio balances is distinct from recording exported transaction activity.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
After sign interpretation, map to the **ledger's** convention for the source account: asset in = `+`, out = `−`; liability charge = `−`, payment = `+` (same rule as beancount-reconcile — keep the two skills' config stanzas consistent).
**Dates:** `05/07/2026` is ambiguous (MDY vs DMY). Prove it from the data when possible (a day > 12 disambiguates); otherwise ask once and persist. ISO `2026-05-07` needs no confirmation.
**Payee cleanup:** strip trailing store numbers/reference codes for the *payee* field but keep the raw description as the narration when they differ meaningfully: `payee "TRADER JOES"`, narration `"TRADER JOES #123 SEATTLE WA"`. When in doubt keep the raw string as payee — dedup hashes use the raw description (see dedup.md), not the cleaned payee.
The manifest describes importing bank, card, and brokerage export files into a local ledger. This section instead introduces a SimpleFIN feed and explicitly instructs the agent to use a secret access URL to fetch account and transaction data with curl, expanding the workflow into authenticated remote financial-data acquisition rather than merely parsing supplied files.
No suspicious patterns detected.