Expense Tracker

Warn

Audited by Socket on Oct 25, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: The stated purpose is coherent for a finance skill, and the referenced vendor APIs are plausible, but the actual trust anchor is an undocumented `accounting-mcp` wrapper plus a generic `ocr_receipt` tool. Because sensitive financial data and likely API credentials would flow through unverifiable intermediary tooling, this skill presents high supply-chain and credential-forwarding risk despite otherwise legitimate business use.

Confidence: 84%Severity: 81%
Audit Metadata
Analyzed At
Oct 25, 2026, 01:12 AM
Package URL
pkg:socket/skills-sh/claude-office-skills%2Fskills%2Fexpense-tracker%2F@72e0ef8ac7e2450a2643da3e66bcfa9d817ad6a923c5f3e212494680622847e7