Expense Tracker
Warn
Audited by Socket on Oct 25, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: The stated purpose is coherent for a finance skill, and the referenced vendor APIs are plausible, but the actual trust anchor is an undocumented `accounting-mcp` wrapper plus a generic `ocr_receipt` tool. Because sensitive financial data and likely API credentials would flow through unverifiable intermediary tooling, this skill presents high supply-chain and credential-forwarding risk despite otherwise legitimate business use.
Confidence: 84%Severity: 81%
Audit Metadata