The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the simplefin-pp-cli binary using NPM (@mvanhorn/printing-press-library) and Go (github.com/mvanhorn/...). These sources are official repositories associated with the verified vendor mvanhorn.
[COMMAND_EXECUTION]: The skill utilizes the bash tool to run financial analysis commands such as calculating net worth, tracking cash flow, and identifying recurring subscriptions. These operations are performed using the local CLI binary.
[DATA_EXFILTRATION]: The CLI provides a documented --deliver flag to route reports to local files or external webhooks for user workflows. Sensitive SimpleFIN Access URLs are managed locally and stored in configuration files with restricted permissions (chmod 600) to prevent unauthorized access.
[INDIRECT_PROMPT_INJECTION]: The skill processes external transaction data (such as payee names and descriptions) from financial institutions. While this represents a potential data ingestion surface, the risk is inherent to the skill's purpose as a financial analytical tool and is mitigated by the tool's reliance on deterministic local processing logic.

pp-simplefin