Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it promises local bookkeeping but also directs the agent to access a connected online ledger.
Before installing, have the hosted-ledger fallback removed or require separate approval naming the online service, ledger, and allowed operations. Review each proposed entry and destination, and keep a ledger backup. The material concern is contradictory access scope, not evidence of intentional theft or destruction.
The supplied command implements a file-import workflow rather than property-specific transaction recording. Its mapping, parsing, and duplicate-handling options indicate an import capability outside the declared scope. The --no-input and --apply flags also perform a noninteractive write; although confirmation could exist elsewhere, none is shown in this chunk.
The supplied command implements a file-import workflow rather than the declared property-bookkeeping workflow. This is materially inconsistent with the explicit exclusion of statement-file importing. The --no-input option also disables interactive confirmation, although the isolated chunk cannot establish whether confirmation occurred earlier. The local ledger access itself is consistent with the description.
A general price-refresh operation is not among the declared transaction-recording capabilities. Representing property as a priced lot does not itself imply refreshing market-price data. The snippet also shows no proposal or confirmation step, although prior confirmation elsewhere cannot be ruled out.
The description excludes Beancount.io-hosted ledgers, but discovery explicitly directs the agent to use connected hosted-ledger MCP tools. This crosses the advertised local-only boundary and could cause sensitive financial queries or approved changes to reach a remote ledger without a separate scope decision; the confirmation requirements reduce write risk but do not resolve the routing contradiction.
The manifest limits this skill to local ledgers and explicitly says to skip ledgers hosted on Beancount.io. These instructions instead direct the agent to use the hosted server's tools, including for skills without a matching hosted prompt, and offer connecting the server or cloning the hosted ledger when disconnected.
The manifest delegates bank or loan statement files to beancount-import, but L37–L41 instruct importing a source CSV into an account, and L69–L77 provide the command to apply those imports to the ledger. This is a general cash-export ingestion workflow, not simply reading a mortgage payment split to construct a proposed property transaction; requiring approval does not resolve the scope mismatch.
No suspicious patterns detected.
