f3-insights/automation-toolbox

What you get · Quick start · Departments · How it works · Getting started · Security · License

Agents and skills for Claude Code that run the recurring work of a finance and operations practice: closing the books, forecasting, reporting to executives, running client engagements, mapping processes, and shipping software. Built and used by F3 Insights.

---

What you get

Most agent collections give you prompts. This one gives you the back office as a working system: each recurring job a finance and operations team does, written down as a workflow an agent can run, reviewed by a second agent, and finished by plain code you can read.

Who it is for

• Fractional CFOs, controllers and finance consultants who close several companies’ books, forecast and report every month.
• Operations and process consultants who run discovery, map processes and scope automation for clients.
• Small-firm owners who want their week (mail, meetings, tasks, decisions) handled by agents they can audit.
• Engineers building agent systems for back-office work, who want a worked example of orchestrators, checkers and change sets at scale.

A month with the toolbox

Quick start

Install with one command (needs Node.js 18 or later; nothing is published to or downloaded from the npm registry, npx fetches this repository from GitHub):

npx github:F3-Insights/automation-toolbox list                 # see the departments
npx github:F3-Insights/automation-toolbox install marketing    # install one, with the skills it needs

Restart Claude Code, open a session anywhere and ask:

Use the unslop-email skill on this draft: paste an email you were about to send

Use the unslop-technical skill on this README: paste a README or design doc

The getting-started guide walks from there to your first full workflow, with the settings each one needs.

Departments

Each folder at the root is a department. Open its README for what is inside and what each piece needs to run. The departments fall into three groups, the same three the banner’s tiles show.

Finance core

4 departments · 56 agents · 36 skills. The close, the forecast and the numbers leadership reads.

Delivery

7 departments · 53 agents · 51 skills. Client engagements, from the first lead to the last invoice, and the software behind them.

Operator

7 departments · 81 agents · 65 skills. The owner’s own week: mail, meetings, tasks, decisions, notes, and the toolbox itself.

New agents and skills start from templates/: fill-in templates for an orchestrator agent, a sub-agent and a skill, with a small worked example.

How the pieces fit

• An agent is one Markdown file in a department’s agents/ folder. Orchestrators (names ending in -orchestrator) run a whole workflow by dispatching worker agents.
• A skill is a folder in a department’s skills/ folder: the method for one piece of work, with anything only it uses, including its scripts and tests.
• An automation is how a workflow is started on a schedule: a prepare step pulls data before the session, and a finish step applies the approved change set after it.
• Pieces refer to each other by name, across departments. Names are unique repository-wide.
• A shared skill is one several departments use, such as orchestration-workstream, task-stack-workstream or the unslop family. Its single source is in shared/skills/, and each department that uses it holds an identical, generated copy, so a department installs complete on its own. See Shared skills.

The full vocabulary (Run, Automation, Context, rules file, change set, owner settings) is in CONTEXT.md.

Install

There are two ways in. npx copies the departments or skills you choose into Claude Code, which suits most people. Clone and link keeps a git clone as the live source, which suits anyone changing the toolbox or wanting every update the moment they pull.

With npx (recommended)

You need Node.js 18 or later and Python 3.11 or later. The installer is one dependency-free script in bin/; npx fetches it with this repository straight from GitHub.

npx github:F3-Insights/automation-toolbox list                       # departments, with agent and skill counts
npx github:F3-Insights/automation-toolbox list finance               # what one department holds
npx github:F3-Insights/automation-toolbox install finance strategy   # whole departments
npx github:F3-Insights/automation-toolbox install --skill pre-mortem # one skill
npx github:F3-Insights/automation-toolbox install --all              # everything

Updating. Run the same install command again: npx fetches the latest commit and the installer replaces what it installed before. To stay on one version, pin it: npx github:F3-Insights/automation-toolbox#.

Safe by default. The installer never overwrites a skill or agent it did not install: one of yours with the same name is skipped and reported (--force replaces it). It records what it installed in ~/.claude/.f3i-toolbox.json, so uninstall removes only those. Test folders are left out.

After installing. Restart Claude Code. Some scripts need Python packages: pip install pyyaml openpyxl python-pptx pypdf pillow. Skills that need settings say so the first time they run; docs/settings.md lists every one.

Clone and link (for contributors)

The toolbox is kept in department folders so people can find things. Claude Code and other runtimes need one flat list instead: every skill at skills// and every agent under agents/. So the clone is the source you edit, and a link script installs a flat view of it, made only of links back into the clone. Nothing is copied: edit a file in the clone and the change is live at once.

1. Clone the repository and turn on its git hooks, once:

   git config core.hooksPath .githooks
   

2. Build the install once:

   python3 setup/link.py          # or setup/link.sh
   

   It stops, changing nothing, if two pieces share a name. --check shows what it would change.

3. Point your runtime at it. For Claude Code, link its two folders to the install, keeping your old ones as a dated backup (the script prints these lines; it never runs them):

   mv ~/.claude/skills ~/.claude/skills.bak-YYYYMMDD
   ln -s ~/.local/share/f3i-toolbox/skills ~/.claude/skills
   mv ~/.claude/agents ~/.claude/agents.bak-YYYYMMDD
   ln -s ~/.local/share/f3i-toolbox/agents ~/.claude/agents
   

   Another agent runtime is pointed at the same two folders in its own configuration.

4. Fill in your settings: copy settings.example.toml to ~/.config/f3i-toolbox/settings.toml and uncomment the keys you use; docs/settings.md describes each one.

Before you run anything

• What each piece needs. Every department README has a “Needs” column: nothing beyond Claude Code, a web search, the Insights Portal MCP server, Sage Intacct, a command, or an owner setting. Start with pieces that need nothing.
• The Insights Portal. Many productivity, sales and project pieces read and write through F3 Insights’ Portal MCP server. Without it, those pieces stop and say what they need; the finance core works from folders and, for ledger pulls, Sage Intacct.
• Settings and secrets. Scripts read owner settings from ~/.config/f3i-toolbox/settings.toml (or the file F3I_TOOLBOX_SETTINGS names) and secrets from environment variables only. docs/settings.md lists every key and variable; settings.example.toml holds every key, commented out, with a one-line comment each.
• For a runtime. library.yaml at the root declares the settings file to any runtime that runs these agents (Sentinel, for one): the variable that names it, where the scripts look without it, and the example. A runtime that keeps the file in its own home sets the variable for everything it starts (ADR 0005).
• Your facts stay yours. Voice guides, folders and rules files are inputs you supply; nothing here assumes a particular person or company.
• Status. The scripts are tested against invented data and fake servers. See the roadmap for what has not yet been run against live systems.

Checking a change

git config core.hooksPath .githooks       # once per clone
python3 scripts/toolbox_check.py          # what the hook runs

The check fails on private names (from lists kept outside the repository), machine details, real email addresses, secret-shaped strings, duplicate names, broken agent or skill frontmatter, and a copy of a shared skill that differs from its source.

To run the tests, make a virtual environment with pytest, pyyaml, pypdf, openpyxl, python-docx and python-pptx, then:

.venv/bin/python scripts/run_tests.py              # every skill, one pytest process each
.venv/bin/python scripts/run_tests.py accounting   # one department

Shared skills

A skill that several departments use has one source, shared/skills//, and a whole copy in every department that uses it, so each department is complete on its own as a plugin (ADR 0004). shared/ is not a department or a plugin. shared/manifest.yaml lists, for each shared skill, the departments that get a copy, the one it came from first.

• Edit the source, never a copy. A copy is marked by a .shared-copy file naming its source; everything else in it, SKILL.md included, is byte-identical to the source. Change shared/skills//, then run the build and commit the source and the copies together:

  python3 scripts/build_shared.py            # rewrite the copies (--check reports, changes nothing)
  python3 scripts/build_bins.py  # for a plugin department whose copy has scripts
  

• Giving a department a copy is one line in the manifest, then the build. List a department only once its agents or skills use the skill. Removing a department from the line removes its copy.

• Commands. A shared skill’s scripts get one command name with no department prefix, the same in every copy: task_stack_apply.py is task-stack-apply in each plugin that holds it. A department’s own scripts keep the - prefix. A copy’s command that clashes with a department’s own is an error.

• The checks. scripts/toolbox_check.py fails when a copy differs from its source, a listed copy is missing, or a marked copy is no longer listed. The install (setup/link.py) links each shared skill’s source once, however many departments hold a copy, and still refuses two different skills with one name. scripts/run_tests.py tests the source once in place of its copies.

Security: scanned with NVIDIA SkillSpector

Every skill here is scanned with NVIDIA SkillSpector, NVIDIA’s open-source security scanner for AI agent skills, and the results are published in full: read the scan report.

What it is. SkillSpector checks a skill’s instructions and code against 71 vulnerability patterns in 17 categories (prompt injection, data exfiltration, privilege escalation, supply-chain risk, excessive agency, dangerous code and more) and gives each skill a 0 to 100 risk score. It is part of the NVIDIA Verified Skills pipeline NVIDIA uses before it publishes skills.

Why it matters. A skill runs with your permissions: it can read files, run commands and call the network. Skills are shared like software but rarely reviewed like it, and SkillSpector’s research found vulnerabilities in 26.1% of public skills it analysed and signs of malicious intent in 5.2%. These skills touch ledgers, mail and client work, so you should see the evidence before you install them.

What it found. On the latest scan (static analysis, v2.12.0), 101 of 152 skills rated LOW, 32 MEDIUM, 12 HIGH and 7 CRITICAL. The high ratings add up from many smaller findings: scripts that use the environment, files, shell or network without declaring it (including the skills that send an API token to Sage Intacct or the Insights Portal), long reference files the scanner only partly read, and instructions that tell an agent to write a draft or a file. The report lists every high-rated skill and explains each kind of finding, so you can review a skill before you install it.

Scan anything yourself, ours or anyone else’s, before you install it:

uv tool install git+https://github.com/NVIDIA/skillspector.git
skillspector scan path/to/skill --no-llm

A GitHub workflow rescans every skill on each change and once a week.

Documentation

FAQ

Third-party material

Some skills are adapted from other people’s published work. THIRD-PARTY-NOTICES.md lists each one with its upstream and license, and each adapted skill keeps its original license file.

License

The toolbox is source-available under the PolyForm Shield License 1.0.0.

Anyone who gets a copy from you must also get the license terms and this line:

Required Notice: Copyright (c) 2026 F3 Insights (https://f3insights.com)

Third-party skills stay under their own licenses, listed in THIRD-PARTY-NOTICES.md. For a commercial license, contact F3 Insights.

---

Built and used by F3 Insights · Architect the outcome