Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: the skill promises local-only migration but also directs your agent to use connected online financial-ledger tools.
Use a fresh local ledger and explicitly prohibit hosted-tool access until the conflicting routing instructions are corrected. Keep the original exports, preserve source categories, approve mappings and the write destination, and check the migration report. The static scan reported no findings; the Review verdict rests on the verified hosted-ledger scope conflict.
Although using bea is declared, refreshing price data is a distinct capability not described as part of transaction-history migration. The supplied command does not import transactions or perform the stated mapping and reconciliation tasks.
The Identify phase instructs the agent to use connected hosted-ledger MCP tools despite the description excluding Beancount.io-hosted ledgers and the workflow declaring local-only operation. This creates an ambiguous authorization boundary: an agent could perform remote financial-ledger operations under a workflow presented as local, although the supplied file does not specify which hosted tools would be called or demonstrate actual remote changes.
The skill explicitly excludes Beancount.io-hosted ledgers, but this shared reference directs hosted-ledger workflows to use MCP tools, including skills without a matching hosted prompt. That conflicting instruction could lead the agent to perform an unsupported migration against a live hosted financial ledger rather than stop at the declared scope boundary. The confirmation requirements reduce the risk, and there is no evidence of credential theft or deliberate exfiltration, but they do not resolve the conflicting authorization to use an excluded destination.
The instruction to ignore source categories contradicts the skill's category-aware migration purpose and assumes authoritative ledger history that a fresh ledger does not have. Following it can discard classification information and produce incorrect or incomplete financial records; transaction counts and balance reconciliation would not necessarily detect those classification errors.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
After sign interpretation, map to the **ledger's** convention for the source account: asset in = `+`, out = `−`; liability charge = `−`, payment = `+` (same rule as beancount-reconcile — keep the two skills' config stanzas consistent).
**Dates:** `05/07/2026` is ambiguous (MDY vs DMY). Prove it from the data when possible (a day > 12 disambiguates); otherwise ask once and persist. ISO `2026-05-07` needs no confirmation.
**Payee cleanup:** strip trailing store numbers/reference codes for the *payee* field but keep the raw description as the narration when they differ meaningfully: `payee "TRADER JOES"`, narration `"TRADER JOES #123 SEATTLE WA"`. When in doubt keep the raw string as payee — dedup hashes use the raw description (see dedup.md), not the cleaned payee.
No suspicious patterns detected.