Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because this local importer skill also directs the agent to hosted financial-account tools without clearly limiting their use.
Require a clear local-only boundary before use: hosted-account tools and cloud cloning should be excluded from this importer-authoring workflow. Keep live ledger changes separately authorized, review generated outputs and the runner diff, and redact bank samples before saving or committing test fixtures.
The command invokes add transactions --from "$batch" --into "$target", performing a transaction-write operation rather than importer authoring, testing, or runner configuration. This directly conflicts with the stated exclusion of ledger writes.
The supplied command executes an import with --apply and an explicit target. This materially differs from developing and validating reusable importer code and crosses the description's explicit exclusion of ledger writes. The chunk contains no importer authoring, golden-file review, or test-harness execution.
The command performs a ledger write using add transaction rather than creating, repairing, testing, or configuring an importer. This is an explicitly excluded capability, not a supporting implementation detail.
The command invokes add balance with a ledger, account, date, amount, and output target. This is a ledger mutation, not a supporting importer-development operation, and directly contradicts the declared instruction to skip ledger writes.
The command invokes bea --file "$ledger" ... add price with a date, commodity, amount, and destination. This is a ledger price-write operation, not a supporting step for implementing or testing an importer, and directly contradicts the declared exclusion of ledger writes.
The command bea --file "$ledger" ... add open ... --into "$open_target" performs a ledger-writing operation rather than importer authoring, testing, or ingest-runner configuration. This directly conflicts with the declared scope.
The command uses add open and --into "$open_target" to write an account-opening directive. This is a ledger-writing operation, not importer authoring, testing, or ingest-runner configuration, and directly contradicts the declared scope.
The supplied command adds a note to a ledger rather than generating, repairing, testing, or wiring an importer. This is a direct ledger mutation, which the description explicitly says to skip.
The command uses bea ... add close --date ... --account ... --into ... to modify ledger content. This is not a supporting importer-development operation and directly contradicts the declared exclusion of ledger writes.
The supplied command adds a transaction rather than authoring, testing, or wiring an importer through bea ingest. This is a direct ledger mutation expressly excluded by the declared purpose.
The supplied command performs a price-refresh operation, not importer authoring, testing, or ingest configuration. Price refresh is an undeclared capability and is not a supporting implementation detail of the stated workflow. The snippet does not establish whether ledger files are modified, but the unrelated operation itself is a clear mismatch.
The supplied command performs a direct import workflow using mapping and transformation options. It does not generate or test a reusable importer or invoke its confirmed runner through bea ingest. Its explicit destination also indicates import output handling outside the declared no-ledger-writes scope, although the exact write behavior depends on the CLI's semantics.
The supplied command performs a price-status query, which is not part of the declared importer workflow and has no demonstrated supporting role in it. The command does not indicate ledger writes, but its queried functionality is outside the stated purpose.
The supplied commands perform ledger analysis and reporting rather than importer authoring, golden-file testing, or ingest-runner integration. No connection to importer validation is shown, so these are undeclared capabilities rather than demonstrated supporting implementation details. The commands do not show ledger writes or access to Beancount.io.
The account-opening and batch recipes execute bea add open and bea add transactions against the user's ledger. These modify financial records rather than authoring or testing an importer; requiring confirmation does not bring those operations within the manifest's explicitly limited scope.
The reference directs skills without a hosted prompt to use Beancount.io server tools directly and offers cloud ledger cloning when the server is disconnected. The importer-author skill has no listed hosted prompt, yet its manifest explicitly says to skip ledgers hosted on Beancount.io.
The reference provides operational instructions for applying CSV imports and writing ledger transactions, although the skill's declared scope explicitly excludes ledger writes and one-off imports. This conflicting guidance could lead an agent beyond importer authoring into modifying financial records; the explicit approval, preview, and duplicate-review requirements reduce the danger but do not resolve the scope violation.
The compatibility instructions introduce direct ledger modification into an importer-authoring skill that explicitly excludes ledger writes. An agent following this fallback could expand an importer-development task into changes to financial records; the requirements for confirmed writes, approved destinations, and validation reduce the risk but do not resolve the scope conflict. This appears to be overly broad shared documentation rather than a malicious instruction.
The reference introduces an existing-ledger editing workflow into a skill explicitly limited to importer authoring and excluding ledger writes. Adding an import ID changes future deduplication behavior, so attaching one to the wrong entry could silently suppress a legitimate transaction on later imports. The explicit-consent requirement reduces the risk of unauthorized changes, but does not resolve the scope conflict; this appears to be reused operational documentation rather than malicious instruction.
No suspicious patterns detected.
