bookkeeping-automation

SUSPICIOUS: the bookkeeping content itself is benign documentation, but the first-activation companion check adds unnecessary local enumeration and transitive skill installation. The main risk is supply-chain and trust expansion through `npx skills add` targeting an unverifiable third-party owner relative to the listed maintainer, not direct credential theft or finance-data exfiltration.