Ksef Accountant En

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:43 PM UTC
• Version: 2.2.6

Overview

The skill is mostly disclosed and instruction-only, but its examples include unsafe automated accounting posting and running unpinned remote code.

Review before installing with credentials. Do not provide production KSeF tokens unless the platform confirms secret isolation and disables autonomous invocation. Treat the code blocks as examples, require human approval before any invoice submission, payment blocking, or accounting posting, and do not run the unpinned ksef-latarnia script without pinning and verifying the source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/ksef-accounting-workflows.md:62

Finding

Automated Ledger Posting Without Mandatory Human Approval

Content

View full analysis

Vulnerability Details

File Location: references/ksef-accounting-workflows.md:62-72
Vulnerability Type: Automated modification of financial records beyond the declared approval boundary
Risk Level: High

Vulnerable Code Snippet

Rendering diagram...

Technical Analysis

The documented workflow periodically retrieves invoices and automatically posts accounting records when an AI classifier reports confidence above 0.8. Model confidence measures predictive certainty; it does not constitute authorization or establish that the classification is legally or financially correct.

This workflow conflicts with the explicit constraint in SKILL.md requiring user confirmation before modifying accounting records or taking actions with financial consequences. If implemented as shown, a scheduled process would possess both read access to KSeF invoice data and write access to the accounting database without a mandatory human approval boundary.

The package itself is instruction-only and does not execute this workflow. The vulnerability is therefore present in the implementation guidance rather than as active executable behavior inside the Skill.

Attack Path

1. An attacker, compromised supplier, or erroneous upstream system submits a crafted or misleading invoice associated with the organization.
2. The scheduled process queries KSeF and downloads the invoice without manual intervention.
3. Invoice wording or historical supplier data causes the classifier to assign an incorrect category with confidence above 0.8.
4. The workflow follows the Auto-post branch.
5. Incorrect expense, VAT, payable, or other ledger data is written to the accounting database.
6. The erroneous posting may ...[truncated 867 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the Auto-post branch with a mandatory approval state such as Pending accountant approval.
2. Restrict scheduled synchronization credentials to read-only KSeF permissions wherever possible.
3. Separate invoice ingestion, classification, approval, and ledger posting into distinct services or authorization boundaries.
4. Require an authenticated, authorized accountant to approve the proposed account, VAT treatment, amount, accounting period, and counterparty before posting.
5. Use short-lived, least-privilege credentials for the posting service and prevent the classification component from writing directly to production ledgers.
6. Record the invoice, model version, confidence, proposed entry, approving user, approval timestamp, and final posted entry in an immutable audit trail.
7. Treat confidence thresholds only as routing criteria—for example, high confidence may reduce review effort but must not bypass authorization.
8. Add duplicate detection, amount reconciliation, supplier verification, VAT-rule validation, and period-lock checks before posting.
9. Require additional approval for corrections, unusual amounts, new suppliers, bank-account changes, and tax-sensitive classifications.
10. Update the diagram and surrounding documentation to align explicitly with the consent requirement in SKILL.md.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/ksef-troubleshooting.md:448

Finding

Execution of an Unpinned Remote Repository

Content

View full analysis

Vulnerability Details

File Location: references/ksef-troubleshooting.md:448-450
Vulnerability Type: Retrieval and execution of mutable remote code
Risk Level: High

Vulnerable Code Snippet

bash

# Check KSeF status in real time
git clone https://github.com/CIRFMF/ksef-latarnia
cd ksef-latarnia
python check_status.py

Technical Analysis

The troubleshooting instructions clone the current default branch of an external GitHub repository and immediately execute a Python file from it. No commit, release tag, cryptographic digest, signature, or integrity verification is specified.

Consequently, the effective code executed by a user can change after this Skill has been reviewed. The remote repository is outside the audited package boundary, and compromise of its owner account, repository, dependencies, or default branch could turn this diagnostic procedure into arbitrary code execution.

The Skill does not execute these commands autonomously. Exploitation requires a user or implementing agent to follow the documented instructions. Nevertheless, the instructions establish a direct remote-payload retrieval and execution path.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the repository’s software supply chain.
2. The attacker modifies check_status.py or code imported by that script on the default branch.
3. A user follows the Skill’s troubleshooting instructions after the malicious change.
4. git clone retrieves the attacker-controlled revision without displaying or validating a trusted commit.
5. python check_status.py executes the changed code with the current user’s privileges.
6. The payload can access resources available to that process, potentially including files, environment variables, network connectivity, and configured credentials.

Impact Assessment

The resulting privileges are those of the user or service account running Python. Depending on the execution environmen ...[truncated 578 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official, documented, read-only KSeF status endpoint that does not require executing downloaded code.
2. If the repository must be used, reference a specific reviewed commit hash rather than the mutable default branch.
3. Publish and verify a trusted SHA-256 digest or signed release artifact before execution.
4. Require users to inspect the retrieved script and its dependency declarations before running it.
5. Run diagnostics in an isolated container or sandbox with no KSeF token, encryption key, accounting database access, or unnecessary filesystem access.
6. Disable or tightly restrict outbound network access except for the specific status endpoint required by the diagnostic.
7. Use a dedicated unprivileged account and a clean virtual environment.
8. Avoid installing or executing transitive dependencies unless their versions and hashes are pinned.
9. Change the documentation so retrieval and execution are separate, explicit steps with a security warning between them.
10. Document the reviewed commit, review date, expected script hash, required permissions, and expected network destinations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (12)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: ksef-accountant-en
description: "National e-Invoice System (KSeF) accounting assistant in English. Use when working with KSeF 2.0 API, FA(3) invoices, Polish VAT compliance, e-invoice processing, payment matching, VAT registers (JPK_V7), corrective invoices, split payment mechanism (MPP) or Polish accounting workflows. Provides domain knowledge for invoice issuance, purchase processing, expense classification, fraud detection and cash flow forecasting in the KSeF ecosystem."
license: MIT
homepage: https://github.com/alexwoo-awso/skills
source: https://github.com/alexwoo-awso/skills/tree/main/ksef-accountant-en
d

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/ksef-api-reference.md (reported line 78)May include surrounding context.

Endpoint:

http

DELETE /api/online/Session/Terminate
Authorization: SessionToken {token}

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ksef-fa3-examples.md (reported line 20)May include surrounding context.

md

<SystemInfo>Autonomous KSeF Agent v2.1</SystemInfo>
    </Naglowek>

    <!-- Seller -->
    <Podmiot1>
        <DaneIdentyfikacyjne>
            <NIP>1234567890</NIP>

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skill.json (reported line 4)May include surrounding context.

json

{
  "name": "ksef-accountant-en",
  "version": "1.0.0",
  "description": "National e-Invoice System (KSeF) accounting assistant — domain knowledge, architectural patterns and code examples. Does not contain executable code.",
  "license": "MIT",
  "homepage": "https://github.com/alexwoo-awso/skills",
  "source": "https://github.com/alexwoo-awso/skills/tree/main/ksef-accountant-en",
  "type": "instruction-only",
  "has_executable_code": false,
  "has_install_script": false,
  "has_binaries": false,
  "has_runtime_dependencies": false,
  "security": {
    "disable-model-invocation": true,
    "disableModelInvocation": true,
    "allow-model-invocatio

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill name and description explicitly position the assistant as 'in English' for a broadly applicable accounting function. This is a natural-language locale policy concern because it imposes a language constraint without user opt-in or an explicit justification that the skill must operate only in English.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

- `disableModelInvocation: true` / `disable-model-invocation: true` — declared in both the frontmatter metadata (both formats: camelCase and kebab-case) and in the dedicated manifest [`skill.json`](skill.json). The skill should not be invoked autonomously by the model.
- `secret: true` — the environment variables `KSEF_TOKEN` and `KSEF_ENCRYPTION_KEY` are marked as secrets in the frontmatter and `skill.json`, signaling to the platform that they must be isolated and must not be logged or displayed.
- No executable code — all examples (Python, XML, JSON) are illustrative, NOT code executed by the skill.
- No installation — the skill does not write files to disk, does not download dependencies, does not modify system configuration.
- Dedicated manifest [`skill.json`](skill.json) — a machine-readable file with security metadata, environment variable declarations and constraints. If the platform does not parse the SKILL.md frontmatter correctly, it should read metadata from `skill.json`.

**NOTE — registry metadata verification before installation:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow explicitly routes invoices with AI confidence above 0.8 to 'Auto-post' without any warning, approval gate, or control statement about accounting risk. In an accounting skill, this can normalize autonomous financial posting of misclassified invoices, leading to incorrect ledgers, VAT treatment errors, and compliance issues if users implement it as written.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/ksef-security-compliance.md (reported line 494)May include surrounding context.

md

"""
    session = requests.Session()

    # 1. Verify certificate (NEVER verify=False)
    session.verify = certifi.where()

    # 2. Use strong cipher suites

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description states the skill provides only domain knowledge, architectural patterns, and code examples, and explicitly says it does not contain executable code. However, the env section defines operational inputs for authentication, encryption, and remote API targeting, which implies intended practical execution beyond a purely documentation-only artifact.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The KSEF_TOKEN description asserts there is no token storage or transmission, but the KSEF_ENCRYPTION_KEY description says it is for secure token storage. Even without code, these manifest statements contradict each other about whether token storage is part of the skill's intended behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The examples export sales and purchase registers containing invoice numbers, KSeF identifiers, names, NIPs, and financial amounts directly to Excel files, but do not warn about confidentiality, access control, or storage risks. In a business-accounting context, this could encourage users to create unprotected local spreadsheets with sensitive tax and commercial data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The document presents headings, notes, comments, and validation messages entirely in English even though it is centered on Polish KSeF/FA(3) invoicing artifacts. Because the file does not offer a language or locale choice, it can be read as forcing a specific language presentation without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.