setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
First-time onboarding for findash. You automate everything safe and local, then guide the human through everything that needs them. You never enter the user's secrets yourself and never run anything that captures their passwords through this session — you tell them exactly what to put where, and they do it. Local financial directories are mode 700 and their files mode 600; findash-doctor enforces this through scripts/harden_permissions.py.
Run the findash-doctor skill (diagnose → auto-fix → report). It creates data/ inbox/ .secrets/, fixes file modes, installs the React dashboard dependencies, and initializes the DB. It installs bank-scraper dependencies only after the user opts into a bank source. Read its report: the 🚫 Blockers and ⚠️ Optional lines are exactly the steps below that the human still has to do. See ../findash-doctor/SKILL.md.
The examples below are deliberately unusable placeholders. Leaving a section unfinished is equivalent to omitting it: the doctor and runtime require all of that integration's values to be non-placeholder before enabling it.
Tell the user to create .secrets/findash and chmod 600 it. Give them this single block to paste and edit — they keep only the sections they need:
# .secrets/findash — chmod 600. Omit any section you don't use.
[drive]
root_folder_id=<from your vault folder's Drive URL: drive.google.com/drive/folders/<ID>>
[hapoalim]
user_code=<your hapoalim user code>
password=<your hapoalim password>
[cal]
username=<your cal username>
password=<your cal password>
[pdf-passwords]
<payslip-filename-pattern>=<password>
[ibkr]
# IBKR auth is the official Interactive Brokers connector you add in Claude (no
# password here). The account IBKR maps onto is resolved automatically by
# /findash:fetch-investments and stored in the DB — nothing to set here.
# account_name=<legacy override only — pre-existing installs>
# account_ids=<comma-separated IBKR account ids>
# base_currency=ILSThen: chmod 600 .secrets/findash.
Do not collect these values in the conversation or write the file yourself — the user pastes their own secrets in. Drive authorization lives in the Google Drive connector the user adds in Claude (step 3), not here.
Coming from the old per-file layout? Legacy .secrets/{drive,hapoalim,cal,pdf-passwords} files are no longer read. Tell the user to copy each value into the matching [section] of .secrets/findash and delete the old files — until they do, that integration won't work. Don't move their secrets for them.
These need a browser or an interactive terminal — you cannot do them, so print the exact commands and let the user run them:
+ → Connectors → Add connector → Browse connectors, search "Google Drive", pick it, and sign in with the Google account that owns the vault. Confirm with /mcp and restart Claude Code so the session picks it up. Then the user creates the vault folder in Drive and puts its ID in [drive] root_folder_id; doctor creates/validates every fixed public vault folder idempotently through the connector. Drive powers manual-drop ingest; without it the full sync still runs degraded, so this step can be deferred. node scripts/fetch_bank.js --company=hapoalim --setup
node scripts/fetch_bank.js --company=visaCal --setupLog in, complete OTP / CAPTCHA, trust the device, then press Enter. The profile is saved under ~/.cache/findash/chromium-profile/<companyId>/ and reused silently afterward. Chromium's sandbox remains enabled. Only inside a trusted isolated container running as root, append --disable-browser-sandbox if Chromium cannot launch.
+ → Connectors → Add connector → Browse connectors, search "ibkr", pick Interactive Brokers (IBKR) (under Anthropic & Partners), and log in with your IBKR credentials. Confirm with /mcp (Interactive Brokers (IBKR) · connected), and restart Claude Code so the session picks it up.fetch-investments resolves which findash account IBKRfeeds (attaching to an existing broker when the ledgers clearly match — some brokers are IBKR wrappers underneath — creating one for IBKR-only users, asking only when genuinely ambiguous) and persists the choice in the DB. There is nothing to configure by hand.
/findash:fetch-investments in an interactive session. It ingests your IBKR trade history onto the mapped account (so you stop screenshotting trades) plus a reconciliation snapshot. It's read-only — deny any tool that would place an order or move funds. The account it maps onto is resolved automatically (see step 2). If you don't use IBKR, skip this entirely.Run findash-doctor again and confirm it reports all-systems-go (or only optional gaps for features the user doesn't want). Point the user at docs/setup.md for the full reference.
Finish with the two independent entry points:
/findash:sync-finance-data — fetch and ingest every configured source../run_dashboard.sh — run the localhost React dashboard; its server refreshes market references every 30 minutes.--setup on their behalf (these need a human at a browser), never print secret values..secrets/findash is the only place findash reads credentials from — there is no per-file fallback.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.