Security audit
Security checks for vulnerabilities and agentic risk
The skill requires approval before financial changes, but its local-only description conflicts with instructions to operate on a connected cloud ledger.
If you expect local-only operation, require the hosted fallback to be removed or disabled. Otherwise, separately approve the hosted service and ledger before its tools are used. Back up your ledger and review every proposed financial entry.
The command implements a file-import workflow rather than recording a described individual investment event. That is materially inconsistent with the description's explicit exclusion of broker statement files. The --apply and --no-input flags also apply changes without interactive confirmation; although prior confirmation could exist elsewhere, none is demonstrated in this chunk.
The command implements an import-file workflow rather than recording a user-described investment event. Its export input and CSV mapping configuration align with the separately excluded import capability. The --no-input flag establishes non-interactive execution, but this chunk alone does not prove that confirmation was absent earlier.
The command uses add balance, which records an expected account balance rather than a buy, sell, dividend, transfer, or other declared investment event. Although the CLI and ledger resources match the description, this chunk implements a distinct ledger operation without any shown connection to a supported investment event. The chunk also shows no proposal or confirmation step, though that could occur in surrounding code.
The command uses add close --account, which closes a Beancount account. Account closure is a distinct ledger-management operation, not a buy, sell, dividend, transfer, vest, or other listed investment event. Although the local ledger and bea interface match the description, the operation itself is outside the declared scope.
The query summarizes existing disposals across a year and separates gains by holding period. This is a reporting or tax-oriented analytical capability, not merely retrieving the booking-produced gain for a trade being recorded. Although use of the local ledger and bea is consistent with the description, the scope of this query extends beyond the declared transaction-recording workflow.
The supplied command invokes price refresh, a price-maintenance operation not included in the declared investment-event workflow. It does not propose or record a buy, sell, dividend, transfer, or other listed event. Although price lookup could support investment recording, this command explicitly refreshes prices rather than merely looking up a price for an event. The --no-input flag establishes non-interactive execution but does not, by itself, prove that prior confirmation was absent.
The command passes "$option_posting" to the transaction writer, indicating an options-related entry outside the declared scope. The variable's contents are not supplied, so the exact options event cannot be verified. The local bea ledger operation otherwise matches the description. The --no-input flag alone does not establish a confirmation violation because confirmation could occur before this command runs.
The discovery workflow directs the agent to use connected hosted-ledger tools despite the metadata explicitly excluding hosted ledgers. This creates a backend-selection boundary violation: a workflow advertised as local-only can perform remote financial-data operations without a separate authorization to switch services, although the explicit write-confirmation requirement limits the risk of unapproved changes.
The manifest explicitly excludes ledgers hosted on Beancount.io. In contrast, this reference instructs skills to use the hosted server's tools and explicitly extends that instruction to skills without a hosted prompt, which includes beancount-trade. Following these instructions would move the trade workflow beyond its declared local-ledger scope.
The recipes preview and apply entire CSV exports to the ledger, using cash-account mappings and expense categorization described earlier in the file. This is a general statement-import workflow, not an implementation detail of recording a described investment event; the manifest explicitly directs broker statement files and everyday entries to other skills.
The runnable BQL recipes analyze expenses, monthly burn, subscriptions, and anomalous purchases, then calculate investment market values, unrealized gains, and allocation. These are standalone analytical capabilities rather than checks needed to record a proposed trade; the manifest also explicitly routes performance questions to beancount-ask.
The queries at L16 and L26 retrieve historical sales across an entire year and aggregate realized gains by holding period and currency. This is a standalone historical reporting capability, rather than calculating the booking-produced gain needed to record a described sale, and exceeds the manifest's event-recording scope.
No suspicious patterns detected.
