pp-simplefin

SUSPICIOUS: the skill’s capabilities mostly match its purpose and it appears to use official SimpleFIN-style auth and same-publisher install paths, so this is not fundamentally incompatible with a personal-finance sync tool. The main risks are supply-chain trust in externally installed CLIs, unpinned Go installs, sensitive credential handling, optional webhook export of financial data, and transitive MCP installation.