Security audit

发票识别

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the invoice OCR workflow it claims, but it handles sensitive invoices and cloud credentials with weak disclosure and insecure credential practices.

Review before installing. Use this only if you are comfortable sending invoice contents to Alibaba Cloud OCR. Do not paste cloud secrets into chat; prefer a dedicated low-privilege RAM credential configured outside the conversation, rotate/delete stored keys, monitor billing and logs, and treat generated spreadsheets from untrusted invoices cautiously.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/recognize_invoices.py:59
Finding: Aliyun Access Key Secret Is Echoed and Persisted in Plaintext
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:113
Finding: Documentation Recommends Excessive Aliyun OCR Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/recognize_invoices.py:285
Finding: Untrusted OCR Results Are Written to XLSX Without Formula Neutralization
Content: View full analysis
dict: """从发票数据中提取字段，按用户要求的字段名""" # 默认值为空字符串 result = {k: "" for k in HEADERS} # 发票号码 = 发票代码 + 发票号码 invoice_code = invoice.get("invoiceCode", "") invoice_number = invoice.get("invoiceNumber", "") if invoice_code and invoice_number: result["发票号码"] = f"{invoice_code} {invoice_number}" elif invoice_number: result["发票号码"] = invoice_number elif invoice_code: result["发票号码"] = invoice_code result["开票日期"] = invoice.get("invoiceDate", "") result["购买方信息"] = invoice.get("purchaserName", "") result["销售方信息"] = invoice.get("sellerName", "") result["价税合计"] = invoice.get("totalAmount", "") # 金额信息 result["金额"] = invoice.get("invoiceAmountPreTax", "") result["税额"] = invoice.get("invoiceTax", "") # 提取明细（取第一条） details = invoice.get("invoiceDetails", []) if details: # 合并所有明细的项目名称 item_names = [d.get("itemName", "") for d in details if d.get("itemName")] result["项目名称"] = "; ".join(item_names) # 第一个明细的详细信息 first_detail = details[0] result["规格型号"] = first_detail.get("specification", "") result["单位"] = first_detail.get("unit", "") result["数量"] = str(first_detail.get("quantity", "")) result["单价"] = first_detail.get("unitPrice", "") result["金额"] = first_detail.get("amount", result["金额"]) result["税率"] = first_detail.get("taxRate", "") result["税额"] = first_detail.get("tax", result["税额"]) return result ``` The resulting strings are written directly into workbook cells: ```python for row_idx, invoice in enumerate(results, 2): for co ...[truncated 2294 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation states that invoice files are sent to Alibaba Cloud OCR, but it does not clearly warn users that potentially sensitive financial documents will leave the local environment and be processed by a third party. Invoices commonly contain personal, tax, banking, and business data, so lack of disclosure undermines informed consent and can create privacy/compliance issues.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directly instructs the agent to solicit cloud credentials from the user in plain conversation, which is a dangerous secret-collection pattern. In the context of an OCR skill that also performs network operations, this is more dangerous because the same workflow both acquires privileged credentials and sends sensitive documents to an external provider, increasing the blast radius if mishandled or logged.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises capabilities that imply local file access, file writing, and network exfiltration to a third-party OCR service, but it does not declare an explicit tool/permission scope. That omission weakens transparency and reviewability, making it easier for an agent or user to invoke data-accessing behavior without clear guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation states that invoice files are sent to Alibaba Cloud OCR, but it does not clearly warn users that potentially sensitive financial documents will leave the local environment and be processed by a third party. Invoices commonly contain personal, tax, banking, and business data, so lack of disclosure undermines informed consent and can create privacy/compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document instructs users to upload raw invoice files and use long-lived AccessKey credentials, but it does not warn that invoices commonly contain sensitive financial and personally identifiable information, nor does it provide basic credential-handling or data-protection guidance. In the context of an OCR skill that explicitly asks users for AccessKey ID/Secret and processes invoice images in bulk, this omission can lead to unsafe credential sharing, over-privileged keys, and inadvertent transmission or retention of sensitive documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code stores AccessKey credentials in plaintext in a local config.json file with no permission hardening, encryption, or warning to the user. If the host is multi-user, backed up insecurely, committed to source control, or otherwise exposed, the cloud credentials can be stolen and abused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script uploads raw invoice files to Aliyun OCR over the network without a clear runtime warning or explicit consent step. Invoices commonly contain sensitive personal, financial, and tax data, so silent third-party transfer can create privacy, compliance, and data-handling risk even if the remote service is legitimate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: 整个技能描述、使用说明和交互示例均以中文固定呈现，且未说明是否支持其他语言或允许用户选择语言。按规则，若技能强制特定语言而没有用户选择或明确的地域/合规理由，可视为自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All user-facing docstrings, prompts, usage text, and status messages are fixed in Chinese. Under the stated policy, forcing a specific language without offering user choice or clearly documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The --list-config mode discloses whether credentials are present and prints the full AccessKey ID, which is unnecessary for OCR processing and can aid local reconnaissance or shoulder-surfing. While it masks the secret, exposing credential metadata still increases the attack surface on a shared workstation or recorded terminal session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.