Security audit

Invoice Engine

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it asks an agent to store sensitive billing data and potentially send invoices or reminders automatically without enough safeguards.

Review before installing. Use this only with explicit confirmation gates for creating invoices, sending reminders, enabling recurring billing, and recording payments. Keep client and invoice records in a protected datastore or locked-down files, avoid storing tax IDs or payment references unless necessary, and do not enable cron, heartbeat, daily memory logging, or auto-send behavior until recipients and review steps are clearly controlled.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: Plaintext Storage of Customer and Financially Sensitive Data
Content: View full analysis
$5,000" created: "2026-01-15" lifetime_revenue: 12500.00 invoices_sent: 3 invoices_paid: 2 avg_days_to_pay: 22 ``` It separately directs agents to store invoice amounts, payment status, and transaction records in another YAML ledger: ```yaml # invoices.yaml invoices: - number: "INV-2026.02.001" client_id: "CLI-001" status: "sent" issue_date: "2026-02-13" due_date: "2026-03-15" currency: "USD" subtotal: 5000.00 discount: 0 tax: 0 total: 5000.00 amount_paid: 0 balance_due: 5000.00 payment_terms: "net-30" line_items: - description: "AI Integration Consulting — February" qty: 20 rate: 250.00 amount: 5000.00 payments: [] notes: "" sent_date: "2026-02-13" reminders_sent: 0 created: "2026-02-13T10:30:00Z" ``` ### Technical Analysis The prescribed storage design places personally identifiable information, tax identifiers, billing addresses, commercial history, outstanding balances, and payment metadata in ordinary plaintext workspace files. The skill specifies no encryption, restrictive file per ...[truncated 2231 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises recurring billing auto-generation and overdue reminder automation without warning that these features may create, modify, or send financial communications using client data. In a financial workflow, silent automation can lead to unauthorized invoices, accidental outbound messaging, privacy exposure, and business harm if the agent acts without explicit review or consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger phrases are broad, natural-language commands like "What's overdue?" and "Revenue this month," which could be matched during ordinary conversation without clear user intent to invoke the skill. In an agent environment, this increases the risk of unintended access to financial records or execution of invoice-related actions based on ambiguous prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to persist sensitive client billing data, contact details, addresses, and tax identifiers in workspace YAML files, but provides no privacy, access-control, retention, or minimization guidance. In an agent environment, workspace files may be broadly accessible to other tools, users, or later tasks, creating a real risk of unauthorized disclosure of personal and financial data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes automated reminders, notifications, and auto-send behavior to external recipients without requiring explicit approval, preview, recipient verification, or disclosure that messages may be sent outside the system. That can cause unintended external communications, disclosure of invoice details to the wrong party, or premature/escalatory collection actions triggered by stale or incorrect data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill’s manifest and README describe an invoicing and accounts-receivable capability, but this section advertises paid context packs, competitor analysis, and other unrelated skills. That marketing capability is not justified by the stated purpose of creating, managing, and tracking invoices.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.