quicken — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited quicken (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read Quicken's live Core Data SQLite database without modifying it. Prefer precise, auditable queries over broad exports.
sqlite3 -readonly or a library's mode=ro option. Never issue writes, migrations, vacuuming, or repair commands.LIMIT for transaction-level output, avoid SELECT *, and do not expose database paths, account numbers, routing numbers, login fields, GUIDs, or unrelated records in the response. The one path exception is database selection: when the probe finds multiple candidates, show only the candidate paths needed for the user to choose, then do not repeat them in the financial answer.Use an explicit user-provided path first, then QUICKEN_DB_PATH. If neither is present, resolve the helper path relative to this SKILL.md and run the bundled probe:
python3 <skill-directory>/scripts/quicken_db.py probePass either a .quicken bundle or its data file with --db. The probe reads schema metadata only. It refuses to choose silently when multiple bundles exist; present the candidates and ask the user which file to use.
Do not use file size as an unlock test. An encrypted Quicken stub is still non-empty. Verify that ZACCOUNT exists in sqlite_master, as the probe does.
Do not infer readiness from a running Quicken process, a lock plist, or a neighboring catalog container. The process can run without a document open, and the catalog is not the Core Data database. Query only the selected bundle's data file and require the expected schema tables.
After selecting the file, keep its resolved path in a task-specific variable such as QUICKEN_SELECTED_DB; do not repurpose HOME or other system variables.
SELECT Z_PK AS id, ZNAME AS name, ZTYPENAME AS type,
ZCURRENCY AS currency, ZACTIVE AS active, ZCLOSED AS closed
FROM ZACCOUNT
ORDER BY ZNAME;Z_ENT: SELECT Z_ENT FROM Z_PRIMARYKEY WHERE Z_NAME = 'CategoryTag';2001-01-01 00:00:00 UTC; add 978307200 to display them as Unix timestamps.COALESCE(t.ZPOSTEDDATE, t.ZENTEREDDATE) for transaction dates.>= start and < end + 1 day. Comparing to midnight on the end date omits every later timestamp that day—and can omit the entire day when Quicken stores transactions at noon.ZCASHFLOWTRANSACTIONENTRY.ZAMOUNT, not the repeated top-level transaction amount, after joining splits.COUNT(DISTINCT t.Z_PK) for transaction counts and COUNT(*) only when explicitly counting split rows.(Uncategorized) bucket.sqlite_master and PRAGMA table_info on the selected database because Quicken versions can differ. If this skill is running from a repository checkout, docs/schema.md is optional supplemental context; do not assume that file exists in an installed plugin bundle.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.