validate-beancount

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes bean-check and pip install beancount as part of its core functionality for ledger validation.
  • [EXTERNAL_DOWNLOADS]: The skill uses pip to install the beancount package from the official Python Package Index (PyPI), which is an established and well-known package registry.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external .beancount files, presenting a potential attack surface if the files are attacker-controlled.
  • Ingestion points: Reads the ledger file path provided to bean-check as described in SKILL.md.
  • Boundary markers: None present; the file content is passed to the validator.
  • Capability inventory: The skill executes shell commands and Python subprocess calls.
  • Sanitization: None present; the skill relies on the bean-check utility to validate the input format.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 02:12 PM
Security Audit — agent-trust-hub — validate-beancount