global-invoicing-research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent invoicing report generator, but it tells agents to globally install an unpinned npm package, which creates unnecessary supply-chain and environment risk.

Review this skill before installing. It appears intended for legitimate invoicing compliance report generation, but run any dependency installation in a controlled project or sandbox, prefer a pinned local dependency instead of `npm install -g docx`, and confirm the desired language and report generation before using it for sensitive business or compliance work.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 53
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

markdown

使用 `docx` npm 包（`npm install -g docx`）编写 JavaScript 脚本生成文档。

Technical Analysis

The Skill directs the agent to install the latest available version of the docx npm package globally. The dependency is not pinned to a reviewed version, and no lockfile or integrity-verification mechanism is specified.

npm installations can execute package lifecycle scripts with the permissions of the invoking user. Consequently, a compromised package release or transitive dependency could execute arbitrary code during installation. The -g option also creates a broader system-level footprint than a project-local installation and may affect other Node.js workflows that use globally installed packages.

The audit found no evidence that the named package is currently malicious. The vulnerability arises from the unsafe dependency installation process and its exposure to future supply-chain compromise.

Attack Path

1. An attacker compromises the docx npm package, one of its transitive dependencies, or the relevant package-distribution account.
2. The attacker publishes a malicious release containing an installation lifecycle script or altered runtime code.
3. The Skill is invoked and directs the agent or user to execute npm install -g docx.
4. npm resolves the unpinned dependency to the attacker-controlled release.
5. Malicious lifecycle code executes during installation with the invoking user's privileges, or malicious runtime code executes when the document-generation script imports the package.
6. The payload can access resources available to that user and can modify globally installed Node.js components.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npm. Accessible scope m ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin docx to a specifically reviewed version rather than resolving the latest release:

   bash

   npm install --save-exact docx@<reviewed-version>
   

2. Install the package within a dedicated project directory instead of using the global -g option.
3. Commit a reviewed package.json and package-lock.json, then use:

   bash

   npm ci
   

4. Verify registry configuration, package provenance, publisher identity, and lockfile integrity before installation.
5. Disable lifecycle scripts where compatible with the reviewed package:

   bash

   npm ci --ignore-scripts
   

6. Run dependency installation and report generation in a sandbox or container with minimum privileges, restricted credentials, and limited filesystem and network access.
7. Add automated dependency auditing and controlled update review so version changes are not accepted without security validation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description fixes the output language to Chinese and provides no user-language negotiation. In multilingual environments this can mislead users, degrade review quality, and increase the risk of compliance or implementation errors when stakeholders rely on content they cannot accurately validate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly mandates invocation for a broad set of loosely defined invoicing research requests, including cases where the user did not ask for report generation. This can cause inappropriate auto-selection, override better-matched tools, and push users into unnecessary file-generation workflows that may collect or structure sensitive business/regulatory data without clear user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.