invoice-chase-575d5a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited invoice-chase-575d5a (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pull the AR aging report, score each customer by payment history, draft a tone-matched reminder for each overdue invoice, and present them to the owner. Nothing sends until the owner says so.
User: "who owes me money"
→ Pull AR aging from QuickBooks
→ Cross-reference PayPal settlements (last 14 days)
→ Score each customer: good-payer / occasionally-late / repeat-late
→ Draft tone-matched reminders
→ Show summary table + drafts. Wait for "send these."Ask the owner two questions before running for the first time:
Do not ask again on subsequent runs.
transaction_status: S (settled only — filters out pending and denied transactions that inflate result size and increase rate-limit risk)If PayPal returns a 429 rate limit error:
If a customer shows a settled payment within the query window, flag as "possibly paid — verify" and exclude from the draft queue.
good-payer, occasionally-late, or repeat-late.| Customer | Amount Due | Days Late | Tone | Send via |
|---|---|---|---|---|
| Acme Corp | $1,200 | 18 days | Gentle | PayPal |
| Smith LLC | $450 | 47 days | Firm | Gmail draft |
Then show each draft email in full. Wait for owner to say "send these" or approve individually.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.