israeli-bank-reconciliation
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements best practices for handling sensitive banking credentials by mandating the use of environment variables and providing a fail-closed credential builder that prevents account lockouts caused by incorrect field structures.
- [SAFE]: It provides high transparency regarding security and privacy risks, including a legal disclaimer and specific warnings about headless browser scraping, bank terms of service, and the sensitivity of financial data stored at rest.
- [SAFE]: The skill recommends and prioritizes licensed open banking services (under Israel's Financial Information Service Law) as a more secure, credential-free alternative to traditional scraping methods.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
israeli-bank-scraperslibrary and standard Node.js utilities (csv-parse, dayjs) to perform its primary function. These are established open-source tools appropriate for the skill's intended purpose of financial automation. - [INDIRECT_PROMPT_INJECTION]: As a tool that processes external bank transaction data and accounting records, the skill possesses an indirect prompt injection surface. This risk is mitigated by logic that enforces strict data normalization, transaction status verification, and date range boundaries to ensure only legitimate financial records are processed.
Audit Metadata