Heath Ledger

What to check before installing/using: - Inspect the small client wrappers (scripts/lib/mercury-client.js and scripts/lib/stripe-client.js) to confirm they call the official API endpoints you expect and do not send data elsewhere. - Understand where credentials are stored: tokens you pass (Mercury/Stripe) are saved plaintext in data/heath.db. If this DB is on a shared machine or backup, treat the tokens as sensitive and consider encrypting the DB or using filesystem protections. - Avoid running developer-only scripts (e.g., those with hardcoded /home/andrew/... paths) unless you review/adjust them; they reference local example directories and could attempt to read files from absolute paths. - If you plan to run categorize -> AI -> categorize_ai_results workflow, be aware AI-inferred rules are written into the DB (source='ai') and the project includes logic to promote rules; review how rules are promoted before using on multiple entities to avoid accidental global rule propagation. - Run the skill in an isolated environment (local VM/container) if you want to limit blast radius and inspect network traffic during initial runs. - If you need stronger protection for API tokens, add encryption at rest or use a secrets manager instead of storing tokens plaintext in the SQLite file. Overall: the package appears coherent and consistent with its stated bookkeeping purpose, but take the above operational/privacy steps before running it with real production credentials.