Security audit
Security checks for vulnerabilities and agentic risk
Review is warranted because the skill can use hosted services despite promising local-only operation and can leave financial records unvalidated.
Use a backed-up ledger and require successful validation before committing entries. Explicitly restrict operation to your chosen local ledger, or separately approve the hosted service and ledger. Review every proposed transaction and account opening. The empty static-scan result does not resolve these workflow concerns; the inspected artifacts show no evidence of intentional deception or covert exfiltration.
The command uses add balance, which creates a balance assertion rather than recording an options trade or lifecycle transaction. Although it uses the declared CLI and local ledger resources, its ledger operation falls outside the stated purpose and within the excluded category of other manual entries.
The command uses add price with a commodity, amount, and date, which records price data rather than a transaction. Maintaining commodity prices is not part of the declared transaction-recording scope, and the supplied chunk does not establish it as a supporting step for an options transaction. Use of bea and a local ledger is consistent with the description, but the operation being performed is not.
The command implements a configurable file-import workflow, which is materially different from the declared options-event entry workflow and overlaps the explicitly excluded broker statement import capability. Nothing in the supplied chunk restricts imported records to options events. The --no-input flag makes this command noninteractive, although the chunk alone cannot establish whether review or confirmation occurs elsewhere.
The supplied command performs a price refresh rather than recording an options transaction or lifecycle event. Although it uses the declared CLI and ledger resource, its price-maintenance operation is outside the stated scope and is not shown to be a supporting step for recording a transaction.
The supplied command implements an import workflow rather than an options-specific transaction-entry workflow. Its mapping, rules, and duplicate-handling arguments support importing exported records, which conflicts with the description's explicit exclusion of broker statement imports. Although --apply and --no-input commit changes noninteractively, this snippet alone does not establish whether review and confirmation occurred earlier.
The add open --date ... --account ... --into ... command opens a ledger account; it does not open an options position. Account-opening directives are general ledger maintenance entries, outside the declared options-transaction scope and consistent with the explicitly excluded other manual entries. The local ledger access and use of bea are otherwise consistent with the description.
The ledger query could support transaction validation and is not inherently a mismatch. However, the explicit income-statement and balance-sheet commands provide broader financial reporting, with no visible connection to validating a particular options event. This exceeds the declared recording workflow and conflicts with its exclusion of analytics. The local ledger access itself is consistent with the description.
The description explicitly excludes Beancount.io-hosted ledgers, but Discover directs the agent to use a connected hosted MCP server instead. This conflicting instruction can move a local-only financial workflow across a remote-service trust boundary, potentially exposing transaction data or enabling remote ledger changes; server connectivity alone does not establish user authorization for that switch.
The manifest limits this skill to local ledgers and explicitly says to skip ledgers hosted on Beancount.io. L019–L022 instead instruct the agent to use the connected hosted server, and L031 extends direct server-tool use to skills without a hosted prompt, which includes beancount-options. This routes an explicitly excluded request into a remote-ledger workflow rather than declining it.
The manifest limits the skill to recording options trades and lifecycle events and excludes broker statement imports and other manual entries. This reference instead describes importing simple cash exports (L04–L07), including checking-account rules and expense categorization (L21–L33), and supplies an executable command that applies those imports to the ledger (L77). Review and confirmation do not resolve this scope mismatch.
The fallback permits changes to the live ledger even when no validator is available, and a failed check only blocks a success claim rather than requiring rollback. This creates a financial-record integrity risk: approved but invalid directives could remain in the ledger and disrupt booking, assertions, or downstream reporting. User confirmation and explicit disclosure of an unvalidated result reduce the risk, but do not enforce the skill's promised validated-write boundary.
The manifest limits the skill to recording options trades and lifecycle events and explicitly routes share trades to beancount-trade. Treating a simultaneous stock purchase and collar opening as three legs in one transaction expands that scope to initiating a share trade, unlike stock movements necessarily resulting from option assignment or exercise.
No suspicious patterns detected.
