Accounts Payable Automation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:56 PM UTC
• Version: 1.0.0

Overview

This Markdown-only AP framework skill has no code or system access, but users should treat its auto-approval template and embedded paid links as optional guidance, not controls to adopt blindly.

Install only if you want an AP framework template. Review any suggested invoice auto-approval rule with your finance controls, and treat the linked paid packs and calculators as optional promotional resources rather than required parts of the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:57
• Finding: Hard-Coded Commercial Content Injected into Agent Responses## Vulnerability Details **File Location**: `SKILL.md:57-68` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Context Packs For industry-specific AP frameworks with regulatory requirements, compliance checklists, and automation ROI calculators: → https://afrexai-cto.github.io/context-packs/ ($47/pack) **Fintech Pack** — Payment processing compliance, reconciliation automation **Manufacturing Pack** — 3-way match for complex BOMs, landed cost tracking **Construction Pack** — Retention holdbacks, lien waiver management, AIA billing ## Tools - Revenue Leak Calculator: https://afrexai-cto.github.io/ai-revenue-calculator/ - Agent Setup Wizard: https://afrexai-cto.github.io/agent-setup/ - Bundles: Pick 3 ($97) | All 10 ($197) | Everything ($247) ``` ### Technical Analysis The skill's operative instructions contain commercial links, prices, product bundles, and branded external resources unrelated to the minimum functionality required to generate an accounts-payable management framework. Because this content appears directly in `SKILL.md`, an agent loading the skill may treat it as part of the expected response rather than optional project metadata. This alters the normal response objective from providing neutral accounts-payable guidance to promoting operator-controlled products and websites. The same commercial destinations and offerings are corroborated in `README.md:29-46`, indicating that the links form a sales and deployment funnel rather than an operational dependency of the skill. No executable code, automatic network request, credential access, remote payload retrieval, or local privilege escalation was identified. The risk is therefore limited to instruction-level influence, response integrity, and user redirection. ### Attack Path 1. A user or platform installs or loads the skill. 2. The agent interprets `SKILL.md` as behavioral instruc ...[truncated 1041 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `Context Packs` and `Tools` promotional sections from the operative instructions in `SKILL.md`. 2. Keep commercial resources in `README.md` or another non-operative documentation file, clearly labeled as optional advertising. 3. Do not include external links, prices, bundles, or branded recommendations in generated responses unless the user explicitly requests product recommendations. 4. Separate functional skill instructions from marketing metadata through a clearly defined configuration boundary. 5. If optional resources remain available, disclose ownership or affiliation and explain that they are not required for the skill to function. 6. Apply an allowlist and review process to external links distributed with the project. 7. Add tests confirming that ordinary AP-framework requests produce neutral guidance without unsolicited commercial content.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase is extremely broad: it activates whenever a user discusses payable workflows, vendor relationships, or payment processes. That scope can cause the skill to engage in ordinary finance conversations without clear user intent, increasing the chance of unsolicited workflow guidance or policy-shaped output being injected into unrelated contexts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### 2. Approval Routing
| Threshold | Approver | SLA |
|-----------|----------|-----|
| <$1,000 | Auto-approve (matched) | Immediate |
| $1,000-$10,000 | Department manager | 2 business days |
| $10,000-$50,000 | VP/Director | 3 business days |
| $50,000+ | CFO/Controller | 5 business days |

• Confidence: 85% confidence
• Finding: The approval matrix explicitly includes 'Auto-approve (matched)' for invoices under $1,000, which promotes autonomous financial decision-making without mandatory human review. In an AP context, even matched invoices can be fraudulent, misrouted, or based on compromised vendor data, so normalizing automatic approval can weaken fraud controls and create unauthorized payment risk.

Static analysis

No suspicious patterns detected.