Sure

Get report from Sure personal financial board

Security Scan

The skill's instructions match its stated purpose (fetching data from a Sure account) and are low-risk overall, but there are inconsistencies between the registry metadata and the SKILL.md (missing declared env/binary requirements) and the skill asks you to export a sensitive API key—so verify before installing.

Purpose & Capability

The SKILL.md instructs the agent to call a Sure API endpoint using SURE_API_KEY and SURE_BASE_URL, which is coherent with the name/description. However the registry metadata published for the skill lists no required env vars or binaries, while the SKILL.md metadata requires curl and two env vars. That mismatch is unexpected and could be an authoring omission.

Instruction Scope

Runtime instructions are minimal and stay on-purpose: obtain an API key from the Sure app, set SURE_API_KEY and SURE_BASE_URL, then curl the /api/v1/accounts endpoint. The instructions do not request unrelated files, system paths, or other credentials.

Install Mechanism

No install spec and no code files (instruction-only) — lowest installation risk. The SKILL.md expects curl to be available; that requirement is reasonable but was not reflected in the registry metadata.

Credentials

The required environment variables (SURE_API_KEY, SURE_BASE_URL) are proportionate to the task, but they are sensitive. The skill's top-level registry metadata did not declare these env vars (inconsistency). Also the SKILL.md examples use localhost URLs, which could indicate a self-hosted/dev setup—confirm which endpoint you'll be sending secrets to.

Persistence & Privilege

The skill does not request persistent privileges (always=false), has no install, and does not modify other skills or system-wide settings.

What to consider before installing

This skill appears to do what it says (call your Sure API) but take these precautions before installing: 1) Verify the skill publisher and homepage (https://sure.am) and confirm whether you should point SURE_BASE_URL to that domain or to a local/dev instance — the SKILL.md's localhost examples may be misleading. 2) Only provide an API key you trust the skill with; prefer a limited-scope/test key if available. 3) Be aware the example curl command places the API key on the command line (it may appear in shell history or in process listings); consider safer alternatives (use a config file, stdin, or a short-lived token). 4) Ask the publisher to reconcile the registry metadata (it should declare required env vars and curl). 5) If you need higher assurance, request a signed/verified skill package or vendor documentation before using real credentials.

Sure Skill

Setup

1. Go to your Sure app, example : https://localhost:3000
2. Go to settings and get an API key, example : https://localhost:3000/settings/api_key
3. Export your API KEY and BASE URL as environment variables :

export SURE_API_KEY="YOUR_API_KEY"
export SURE_BASE_URL="YOUR_BASE_URL"

Get accounts

List all accounts amounts

curl -H "X-Api-Key: $SURE_API_KEY" "$SURE_BASE_URL/api/v1/accounts"