中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:20 hr ago Rescan
20 /100
Payroll GL Reconciliation
Reconcile QuickBooks Online payroll GL accounts against payroll provider reports (Gusto, ADP, Paychex) across 12 categories
Documentation-only skill describing a payroll reconciliation pipeline; no executable code present to analyze, with a minor doc mismatch where referenced script paths do not exist.
Skill NamePayroll GL Reconciliation
Duration31.4s
Enginepi
✓
Safe to install
This skill contains only documentation with no actual implementation. Before deploying, ensure the referenced script scripts/pipelines/payroll-reconciliation.py is provided. Review the script for any shell, network, or credential access patterns before use.

Findings 2 items

Severity Finding Location
Low
Referenced script does not exist Doc Mismatch
SKILL.md specifies scripts/pipelines/payroll-reconciliation.py as the entry point but no scripts directory or Python file exists in the package.
scripts/pipelines/payroll-reconciliation.py
→ Provide the actual script implementation or remove the script location reference from documentation.
 SKILL.md:35
Low
Dependencies declared but unverifiable Doc Mismatch
SKILL.md lists openpyxl as a dependency and Node.js QBO client but cannot verify if any code actually uses these libraries.
pip install openpyxl
→ Ensure script implementation properly imports and uses declared dependencies.
 SKILL.md:175
ResourceDeclaredInferredStatusEvidence
Filesystem READ NONE ✓ Aligned SKILL.md mentions reading payroll CSV files but no script exists to verify
Network READ NONE ✓ Aligned SKILL.md mentions QBO API integration but no script exists to verify
Shell NONE NONE — No shell usage documented or present

File Tree

1 files · 9.8 KB · 308 lines
Markdown 1f · 308L
└─ 📝 SKILL.md Markdown 308L · 9.8 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
openpyxl * pip No Listed in SKILL.md but no script exists to verify usage; version not pinned

Security Positives

✓ Skill provides clear negative boundaries to prevent misuse
✓ No obfuscated code, base64, or suspicious patterns found
✓ No credential harvesting mechanisms documented or present
✓ Legitimate accounting use case with proper financial controls (Decimal math)
✓ CDC cache is file-based with no network exfiltration
✓ Clear documentation of 12 reconciliation categories and 8-tab Excel output