Workflow Chain

• Verdict: Pass
• Confidence: Medium
• Analyzed: Apr 19, 2026, 7:33 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill is an instruction-only orchestrator that coherently describes reading local pipeline manifests and client SOPs and running pipeline scripts; it does not request unexpected credentials or installs, but it will execute local scripts that may themselves need credentials or access sensitive financial data, so review those scripts before use.

This skill is coherent for orchestrating local pipeline scripts, but before installing: (1) verify the repository layout exists (scripts/pipelines/manifest.json and clients/*/sop.md) and matches your environment; (2) review each pipeline script the orchestrator will run — they will be executed and may perform network calls or use credentials; (3) confirm how QBO or other credentials are supplied to those scripts and store them with least privilege (prefer a sandbox account for testing); (4) test the orchestrator in a controlled environment and inspect logs and outputs for sensitive data exfiltration; (5) only install/use if you trust the skill source and the pipeline scripts it will run, because the orchestrator itself does not request credentials but will execute code that might.