Bank Reconciler Pro
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code largely matches a bank-reconciliation purpose, but there are unexplained dependencies and minor mismatches (an undeclared external CLI used for PDF parsing and a referenced Feishu push function that isn't implemented) that warrant caution before installing.
This package appears to implement a legitimate reconciliation tool, but review these points before using it on sensitive data: - PDF parsing calls an external CLI: parser._parse_pdf runs 'miaoda-studio-cli doc-parse'. That binary is not declared in metadata; verify you trust that CLI (and avoid running it if you don't control the environment). If the binary is missing the code will raise an error. Running arbitrary local CLI tools on untrusted documents can be risky. - Feishu integration: SKILL.md shows pushing results to Feishu, but the provided code only builds Feishu message payloads (no function to send them). If you need automatic posting, inspect where/how credentials (webhook/app tokens) would be provided — the skill does not request env vars for Feishu, so make sure you don't inadvertently provide credentials to an unimplemented or custom send routine. - Undeclared Python dependencies: code imports openpyxl (used in exporter). Ensure your environment has required packages or sandbox the execution. - Implementation gaps: SKILL.md references push_reconciliation_to_feishu(...) but that function is not among the provided files (could be in omitted/truncated files). Before installing or running, open all files (especially the omitted one(s)) to confirm there are no hidden network endpoints or unexpected behaviors. Recommended actions: 1) Inspect tier_config.py and any omitted files for token validation and network calls. 2) Run the test suite in a sandboxed environment to see missing-dependency failures (pytest is included in tests). 3) If you plan to process real bank statements, run this code on a dedicated, isolated machine and avoid granting unnecessary credentials until you confirm how Feishu/API posting is implemented.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.