Security audit
Security checks across malware telemetry and agentic risk
This skill is a coherent local invoice-analysis helper, but it handles sensitive business tax data and users should keep its endpoint local.
Install only if you intend to let the agent read invoice ledger data, tax IDs, amounts, raw invoice JSON, and attachment metadata from Little Beaver Invoice Assistant. Keep the base URL on 127.0.0.1 or localhost unless you deliberately operate a trusted remote endpoint, and only ask it to open attachments when you expect a local PDF/OFD/XML viewer to launch.
def build_query(args: argparse.Namespace, fields: list[str]) -> str:
pairs: list[tuple[str, str]] = []
for field in fields:
value = getattr(args, field.replace("-", "_"), None)
if value is None or value == "":
continue
if isinstance(value, list):copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
continue
seen.add(candidate)
try:
meta = http_get_json(f"{candidate}/api/metadata", timeout=0.6)
health = http_get_json(f"{candidate}/api/skill/health", timeout=0.6)
except (OSError, URLError, HTTPError, TimeoutError, json.JSONDecodeError):
continueseen.add(candidate)
try:
meta = http_get_json(f"{candidate}/api/metadata", timeout=0.6)
health = http_get_json(f"{candidate}/api/skill/health", timeout=0.6)
except (OSError, URLError, HTTPError, TimeoutError, json.JSONDecodeError):
continue
if meta.get("success") and meta.get("app_name") == APP_NAME and health.get("success"):65/65 vendors flagged this skill as clean.
No suspicious patterns detected.