EnvelopeBudget

Manage budgets, transactions, accounts, envelopes, payees, and reports using the EnvelopeBudget.com API for tracking and organizing finances.

Security Scan

The skill appears to do what it claims (a thin wrapper around the EnvelopeBudget REST API) and requests only a single API key; packaging metadata has a small inconsistency you should check before use.

Purpose & Capability

The name, description, SKILL.md, API reference, and the included eb_api.sh script all align: they call EnvelopeBudget.com REST endpoints and require an API key. However, the registry-level metadata at the top of the submission lists no required env vars or homepage while SKILL.md metadata declares ENVELOPE_BUDGET_API_KEY and a homepage/source URL — this packaging mismatch should be resolved or verified.

Instruction Scope

Runtime instructions are narrowly scoped: use the provided scripts/eb_api.sh to call EnvelopeBudget endpoints. The instructions do not instruct reading unrelated files, scanning the system, or sending data to any endpoint other than https://envelopebudget.com.

Install Mechanism

No install spec (instruction-only) and included helper script only. Nothing is downloaded or executed from arbitrary URLs; the script is plain Bash invoking curl and python3 for JSON pretty-printing.

Credentials

The skill requires a single service credential (ENVELOPE_BUDGET_API_KEY) which is appropriate for a REST API client. The inconsistency between the registry 'Required env vars: none' and SKILL.md's declared requirement should be clarified so users know they must supply an API key.

Persistence & Privilege

The skill does not request elevated platform privileges, does not set always:true, and does not modify other skills or system config. It runs only when invoked.

Scan Findings in Context

[none_detected] expected: Static pre-scan reported no findings. The included script uses curl and python3 which is expected for an API helper.

Assessment

This skill is a simple API wrapper and appears coherent, but before installing: (1) verify the publisher/source (SKILL.md references a GitHub repo and homepage while registry metadata lacks them) to ensure you're trusting the official EnvelopeBudget integration; (2) be prepared to supply your ENVELOPE_BUDGET_API_KEY — only grant a key with the minimal scope needed and rotate it if you stop using the skill; (3) review the included scripts (scripts/eb_api.sh) yourself — they send your API key in the X-API-Key header to https://envelopebudget.com and do not exfiltrate data elsewhere; (4) if you need stronger assurance, request the upstream repo or a verified homepage so you can inspect source and release provenance.

Query and manage budgets on EnvelopeBudget.com via REST API.

Setup

• Requires env: ENVELOPE_BUDGET_API_KEY
• API reference: see references/api-reference.md

Usage

Use the helper script for all API calls:

scripts/eb_api.sh <METHOD> <path> [json_body]

Common workflows

Check budget overview:

scripts/eb_api.sh GET /api/budgets
scripts/eb_api.sh GET /api/budgets/BUDGET_ID/available-to-budget

List recent transactions:

scripts/eb_api.sh GET "/api/transactions/BUDGET_ID?limit=20"
scripts/eb_api.sh GET "/api/transactions/BUDGET_ID?search=grocery&limit=10"

Add a transaction (amounts in cents, negative = spending):

scripts/eb_api.sh POST /api/transactions/BUDGET_ID \
  '{"account_id":"ACCT_ID","payee":"Costco","envelope_id":"ENV_ID","date":"2026-03-06","amount":-8500,"memo":"Groceries"}'

Check envelope balances:

scripts/eb_api.sh GET /api/envelopes/BUDGET_ID

Transfer between envelopes:

scripts/eb_api.sh POST /api/envelopes/BUDGET_ID/transfer \
  '{"from_envelope_id":"FROM_ID","to_envelope_id":"TO_ID","amount":5000}'

Spending report:

scripts/eb_api.sh GET /api/reports/spending-by-category-data/BUDGET_ID

Important notes

• Amounts are in cents: $50.00 = 5000, -$25.50 = -2550
• Negative = outflow (spending), Positive = inflow (income)
• Always fetch budgets first to get budget_id, then accounts/envelopes for their IDs
• For full API details: read references/api-reference.md