Security audit

Invoice Engine

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it asks an agent to store sensitive billing data and potentially send invoices or reminders automatically without enough safeguards.

Review before installing. Use this only with explicit confirmation gates for creating invoices, sending reminders, enabling recurring billing, and recording payments. Keep client and invoice records in a protected datastore or locked-down files, avoid storing tax IDs or payment references unless necessary, and do not enable cron, heartbeat, daily memory logging, or auto-send behavior until recipients and review steps are clearly controlled.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: Plaintext Storage of Customer and Financially Sensitive Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-50` **Additional Location**: `SKILL.md:167-192` **Vulnerability Type**: Plaintext storage of sensitive customer and financial records **Risk Level**: Medium The skill instructs agents to maintain customer information in workspace YAML files: ```yaml # clients.yaml clients: - id: "CLI-001" name: "Acme Corp" contact: "Jane Smith" email: "jane@acme.com" address: line1: "123 Business Ave" line2: "Suite 400" city: "New York" state: "NY" zip: "10001" country: "US" tax_id: "US-EIN-12-3456789" payment_terms: "net-30" # net-15, net-30, net-45, net-60, due-on-receipt, custom preferred_currency: "USD" default_tax_rate: 0 # 0 for B2B cross-border, local rate for domestic notes: "PO required for invoices > $5,000" created: "2026-01-15" lifetime_revenue: 12500.00 invoices_sent: 3 invoices_paid: 2 avg_days_to_pay: 22 ``` It separately directs agents to store invoice amounts, payment status, and transaction records in another YAML ledger: ```yaml # invoices.yaml invoices: - number: "INV-2026.02.001" client_id: "CLI-001" status: "sent" issue_date: "2026-02-13" due_date: "2026-03-15" currency: "USD" subtotal: 5000.00 discount: 0 tax: 0 total: 5000.00 amount_paid: 0 balance_due: 5000.00 payment_terms: "net-30" line_items: - description: "AI Integration Consulting — February" qty: 20 rate: 250.00 amount: 5000.00 payments: [] notes: "" sent_date: "2026-02-13" reminders_sent: 0 created: "2026-02-13T10:30:00Z" ``` ### Technical Analysis The prescribed storage design places personally identifiable information, tax identifiers, billing addresses, commercial history, outstanding balances, and payment metadata in ordinary plaintext workspace files. The skill specifies no encryption, restrictive file per ...[truncated 2231 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Store customer and invoice records in an encrypted, access-controlled datastore rather than unrestricted workspace YAML files. 2. If local files are necessary, create them with owner-only permissions and document the required permission mode. 3. Encrypt sensitive fields or the complete datastore at rest, with keys held outside the project directory and agent memory. 4. Minimize collected data. Do not retain tax identifiers, full addresses, or payment references unless they are operationally required. 5. Separate customer identity data, invoice data, and payment data so access can be granted according to least privilege. 6. Require explicit user confirmation before persisting customer information or enabling recurring automation. 7. Prevent customer details, tax identifiers, invoice contents, and payment references from being copied into daily memory, diagnostic logs, or general chat history. 8. Apply redaction to exports and reports by default, revealing full sensitive fields only when explicitly requested by an authorized user. 9. Define retention periods and provide secure archival and deletion procedures. 10. Document backup encryption, synchronization restrictions, access auditing, and breach-response requirements. 11. Avoid storing complete bank account details, payment credentials, API tokens, or authentication secrets in invoice templates or YAML records. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README advertises recurring billing auto-generation and overdue reminder automation without warning that these features may create, modify, or send financial communications using client data. In a financial workflow, silent automation can lead to unauthorized invoices, accidental outbound messaging, privacy exposure, and business harm if the agent acts without explicit review or consent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The example trigger phrases are broad, natural-language commands like "What's overdue?" and "Revenue this month," which could be matched during ordinary conversation without clear user intent to invoke the skill. In an agent environment, this increases the risk of unintended access to financial records or execution of invoice-related actions based on ambiguous prompts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to persist sensitive client billing data, contact details, addresses, and tax identifiers in workspace YAML files, but provides no privacy, access-control, retention, or minimization guidance. In an agent environment, workspace files may be broadly accessible to other tools, users, or later tasks, creating a real risk of unauthorized disclosure of personal and financial data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes automated reminders, notifications, and auto-send behavior to external recipients without requiring explicit approval, preview, recipient verification, or disclosure that messages may be sent outside the system. That can cause unintended external communications, disclosure of invoice details to the wrong party, or premature/escalatory collection actions triggered by stale or incorrect data.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The skill’s manifest and README describe an invoicing and accounts-receivable capability, but this section advertises paid context packs, competitor analysis, and other unrelated skills. That marketing capability is not justified by the stated purpose of creating, managing, and tracking invoices.

Static analysis

No suspicious patterns detected.