pp-simplefin
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install executable tools from vendor-owned repositories, including the npm package
@mvanhorn/printing-press-libraryand the Go modulegithub.com/mvanhorn/printing-press-library. - [DATA_EXFILTRATION]: The CLI tool supports a
--deliver webhook:<url>flag that allows command output to be POSTed to an arbitrary external URL. This feature provides a mechanism for sensitive financial data, such as account balances, transactions, and investment holdings, to be transmitted out of the local environment. - [COMMAND_EXECUTION]: The skill involves executing shell commands to interact with the financial CLI, manage profiles, and perform data synchronization tasks.
- [CREDENTIALS_UNSAFE]: The skill handles SimpleFIN Access URLs which contain embedded HTTP Basic Auth credentials. These are stored locally in a
credentials.tomlfile, which the documentation notes is secured with restricted file permissions.
Audit Metadata