fpa-configure-actuals — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fpa-configure-actuals (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect the model to real data - from wherever it lives. openfpa is not married to a connector: everything normalizes to one shape ({account: amount}), and where no built-in path exists, you build the ingestion for this source. That's the job, not a workaround - see examples/foxfactory/pull_edgar.py, a SEC-EDGAR adapter the agent wrote from scratch because no built-in one existed.
Core principle: one normalized shape regardless of source, so the engine never cares where the numbers came from - and the agent meets the data where it is.
pyfpa.read_pl_csv(path) reads any two-column Account, Amount CSV (handles $, commas, (parens) negatives) → {account: amount} - it is generic, not P&L-only. For richer tables (aged AR/AP buckets, item-level inventory) there is no rigid reader by design: parse the file to what the model needs - derive DSO from AR aging, DIO from inventory, DPO from AP aging.{account: amount}. openfpa never handles credentials - the MCP server owns auth.source API and its actual report shape. The functions in pyfpa.io.adapters are fixture-backed examples only, not live QuickBooks, NetSuite, or Shopify clients.
{account: amount} (or parses the richer statement to the drivers the model needs). That is the toolkit working exactly as intended.openfpa entrypoint-list <company-root> --kind connector. Reuse a tested company connector when one exists.
openfpa source-profile <company-root> --file <source-file> for supported local tables. Inspect the columns, empty values, and duplicate rows.
openfpa source-register with a stable sourceID, entity, currency, period coverage, extraction method, and location.
openfpa mapping-register. Register deliberate ignores with --status ignored and a rationale. Review with openfpa mapping-list.
openfpa reconcile-source. Flag duplicate and unmapped accounts; never silently drop or overwrite them. For richer tables, build a tested company-specific reconciliation that provides equivalent evidence.
first run openfpa connector-list. Scaffold a bundle with openfpa connector-scaffold from an explicitly redacted CSV fixture. Edit the generated extract_live() path, keep credentials in the host, and run openfpa connector-validate after every change. Fixture validation must remain offline. Once the live command has separate fixture-backed coverage, publish it with openfpa entrypoint-register --kind connector.
Never commit secrets. Live API credentials come from the host environment; MCP servers own their own auth. openfpa ships only synthetic fixtures.
Actuals wired → operate: fpa-monthly-close, fpa-cash-runway, fpa-board-briefing.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.