connector-quickbooks
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and interacts with official Intuit QuickBooks Online domains (
quickbooks.api.intuit.comandsandbox-quickbooks.api.intuit.com). These are recognized as well-known, trusted services for the purpose of accounting integration. - [CREDENTIALS_UNSAFE]: The documentation explicitly identifies security hazards related to Client Secret management in the Motoko environment, advising users against exposing secrets in source code and recommending rotation practices. Usage examples correctly use placeholders for sensitive tokens.
- [REMOTE_CODE_EXECUTION]: Dependencies are managed via the standard Motoko package manager (mops). The
quickbooks-clientpackage is a logical dependency for the functionality described and is consistent with the skill vendor's purpose. - [INDIRECT_PROMPT_INJECTION]: While the skill processes user data to interact with an external API, it provides boundary instructions (e.g., instructing the agent to report unsupported entity types rather than guessing) to help maintain operational scope.
Audit Metadata