Is mono-client-info-374bfb safe to install?

SaferSkills independently audited mono-client-info-374bfb (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

customize/skills/mono-client-info/SKILL.md · 1 file

customize/skills/mono-client-info/SKILL.md4.9 KB · Markdown

name: mono-client-info

description: Fetch Monobank client profile, account balances, card details, and savings jars via the personal API. Requires a MONOBANK_API_TOKEN. Use this skill whenever the user asks about their Monobank accounts, balances, card info, savings jars (банки), FOP/business account details, IBAN, cashback type, or wants an overview of their Monobank financial profile. Also trigger for "мій баланс моно," "скільки на рахунку," "мої банки в моно," "mono jars," "моно рахунки," or any request to see their Monobank account structure. This skill handles authentication and rate limiting automatically.

Monobank Client Info

Fetches the authenticated user's profile, accounts, and savings jars via GET /personal/client-info.

Prerequisites

The user must provide their Monobank API token. There are two ways to obtain it:

Via browser: Go to https://api.monobank.ua/ and scan the QR code with the Monobank app
The token is a string that goes in the X-Token HTTP header

If the user hasn't provided a token, ask them to get one from https://api.monobank.ua/ — it takes 30 seconds via QR code in the Monobank app.

Security note: Tokens are read-only. They cannot initiate transactions or modify account data. Still, treat them as sensitive — never log or display them in outputs.

Key constraints

Rate limit: 1 request per 60 seconds per endpoint. HTTP 429 on excess.
Auth: X-Token header with personal API token
Read-only: No write operations available via personal API
Commercial use prohibited: Monobank explicitly warns that using personal tokens for commercial data aggregation risks sanctions. For multi-user services, use the Corporate API instead.

How to use

Step 1: Fetch client info

curl -s https://api.monobank.ua/personal/client-info \
  -H "X-Token: YOUR_TOKEN_HERE"

Step 2: Parse the response

The response contains three top-level sections:

#### Client profile

Field	Description
`clientId`	Unique client identifier
`name`	Client's full name
`webHookUrl`	Currently set webhook URL (empty if none)
`permissions`	Permission flags for the token

#### Accounts array (accounts)

Each account object:

Field	Description
`id`	Account ID (use this for statement requests)
`sendId`	ID for receiving payments via send.monobank.ua
`balance`	Current balance in minor currency units (kopiyky for UAH)
`creditLimit`	Credit limit in minor units
`type`	Account type: `black`, `white`, `platinum`, `iron`, `fop`, `yellow`
`currencyCode`	ISO 4217 numeric code (980=UAH, 840=USD, 978=EUR)
`cashbackType`	Cashback type: `None`, `UAH`, `Miles`
`maskedPan`	Array of masked card numbers (e.g., `["537541******1234"]`)
`iban`	Account IBAN

#### Jars array (jars)

Each jar (savings goal) object:

Field	Description
`id`	Jar ID
`sendId`	ID for receiving donations
`title`	Jar name set by the user
`description`	Jar description
`currencyCode`	ISO 4217 numeric code
`balance`	Current balance in minor units
`goal`	Target amount in minor units (0 if no goal set)

Step 3: Convert amounts

Critical: All monetary amounts are in minor currency units (kopiyky for UAH, cents for USD/EUR).

Display amount = API amount / 100

Example: balance: 4215350 → 42,153.50 UAH

Step 4: Present results

When presenting to the user:

Show the client name
List each account with: type, masked PAN, currency, balance (converted), credit limit if non-zero, cashback type
List each jar with: title, balance (converted), goal and progress percentage if goal is set
Calculate and show total balance across all UAH accounts
Flag any accounts with negative available balance (balance - creditLimit)
If FOP accounts exist, separate them visually from personal accounts

Example: formatted output structure

👤 Client: Олександр Петренко

💳 Accounts:
  • black (UAH) ****1234 — 42,153.50 ₴ (cashback: UAH)
  • black (USD) ****5678 — $1,250.00
  • fop (UAH) ****9012 — 128,400.00 ₴

🫙 Jars:
  • Відпустка — 15,000.00 / 50,000.00 ₴ (30%)
  • На ремонт — 8,200.00 ₴ (no goal)

Error handling

HTTP 401: Invalid or expired token. Ask the user to regenerate at https://api.monobank.ua/
HTTP 403: AWS WAF block (excessive requests from IP). Wait 24 hours or change IP.
HTTP 429: Rate limit hit. Wait 60 seconds before retrying. Tell the user about the 1 req/min limit.

Account type reference

Type	Description
`black`	Standard debit card (monobank black)
`white`	monobank white card
`platinum`	Premium card
`iron`	monobank iron card
`yellow`	Child's card (monobank yellow)
`fop`	FOP (sole proprietor / ФОП) business account

mono-client-info-374bfb— agent skill

Is mono-client-info-374bfb safe to install?

Monobank Client Info

Prerequisites

Key constraints

How to use

Step 1: Fetch client info

Step 2: Parse the response

Step 3: Convert amounts

Step 4: Present results

Example: formatted output structure

Error handling

Account type reference

Audit the pieces. Scan the whole. Decide.