report-attachment-analyzer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited report-attachment-analyzer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a recurring emailed report (a weekly sales export, a monthly cost CSV, a weekly KPI PDF) into a maintained trend spreadsheet and a refreshed written summary. On each run, find report emails not seen before, extract the configured metrics from their attachments, append one row per reporting period to trends.xlsx, and produce a DRAFT summary document with deltas against the previous period and flagged anomalies. All state lives in OneDrive files, so every run continues exactly where the previous run stopped, in any conversation.
Do not run this skill for a one-off email attachment. Summarising a single attachment once is a plain Email plus Excel task and needs no trend state.
Status: active defines one tracked report: sender, subject pattern, attachment type, cadence, data location, period field, metrics, anomaly threshold and first-run history window.Status: active, stop and gather the configuration in conversation: ask the user for each field listed in references/report-config.md, then write a completed block into that file. Show the block to the user and get a yes before saving, because this edits an existing file.The working folder for a report is the OneDrive path /Documents/Cowork/output/report-attachment-analyzer/<report-name>/, where <report-name> is the kebab-case H2 heading from the config. Call this WORK below. Always pass these full explicit paths to every built-in skill; never accept a session folder as a save location.
a. Use the Excel built-in to create WORK/trends.xlsx with one sheet named Trends and this header row: Period, Received date, Source file, then one column per configured metric in config order. b. Create WORK/processed-log.md containing the table header shown in OUTPUT ARTIFACTS below.
WORK/processed-log.md. Collect every logged identity tuple (received timestamp, sender, subject, attachment filename) and the most recent received date. The log is keyed on these observable fields, not on email message IDs, which the built-in skills do not expose.a. Identify the report attachment. If the message has several attachments, use the configured attachment filename pattern; if it is still ambiguous, ask the user which file is the report. b. Attempt to save a copy of the attachment to WORK/attachments/YYYY-MM-DD-<original-filename>, where the date is the message received date, then verify the file exists at that path. Saving an attachment to a chosen folder is not guaranteed by the built-in skills: if the save fails or cannot be verified, note "copy unavailable" in that message's processed-log.md row and continue with metric extraction. Never claim a copy was saved without verifying it. c. Extract the configured metrics. For xlsx or csv attachments, use the Excel built-in to open the saved copy (or read the attachment content directly when no copy could be saved) and read the values from the configured sheet and metric columns. For PDF attachments, use the PDF built-in to extract the table described in the config and read the metric values from it. d. Determine the reporting period from the configured period field; if the file has no usable date, use the email received date and note this in the run report. e. If a configured metric is missing or unreadable, leave that cell blank and record a data gap. Never estimate or fill in a value.
WORK/trends.xlsx. Appending new rows is allowed; never modify or delete existing rows. If the period already exists in the sheet, do not overwrite it: tell the user a duplicate or resend arrived for that period and ask whether to append it as an extra row with "(revised)" after the period value, or to ignore it.WORK/summary-YYYY-MM-DD.docx (today's date), following the section structure in references/summary-structure.md. The document title must start with DRAFT.WORK/summary-latest.docx. If the user declines or does not answer, leave summary-latest.docx untouched; the dated file already exists either way.WORK/processed-log.md for every message handled in this run, including skipped and unreadable ones, using the statuses defined below. Fill in the identity columns (Received, Sender, Subject, Attachment) exactly as observed, since the next run's dedupe in step 4 matches on them.All under /Documents/Cowork/output/report-attachment-analyzer/<report-name>/ in OneDrive:
trends.xlsx: sheet Trends, append-only, one row per reporting period. Columns: Period, Received date, Source file, then one column per configured metric.summary-YYYY-MM-DD.docx: new versioned summary written every run, structure per references/summary-structure.md, title starts with DRAFT.summary-latest.docx: same content, written only after explicit user approval in step 10.processed-log.md: markdown table with header | Received | Sender | Subject | Attachment | Period | Status | Processed on |. Status is one of: appended, duplicate-skipped, revised-appended, unreadable, data-gap; add "copy unavailable" to the Status cell when the audit copy in step 6b could not be saved.attachments/YYYY-MM-DD-<original-filename>: dated copy of each source attachment, kept for audit where the platform allows saving attachments; messages whose copy could not be saved are marked "copy unavailable" in processed-log.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.