Security audit
Security checks for vulnerabilities and agentic risk
This instruction-only KSeF accounting skill is mostly purpose-aligned, but it needs Review because some examples encourage automatic accounting changes and running unpinned external code in a sensitive financial context.
Before installing, treat this as reference material only. Do not provide production KSeF credentials unless the platform shows the secret and disable-model-invocation controls are enforced. Require human approval before sending invoices, posting accounting entries, or holding payments. Do not run the suggested external GitHub status script without pinning and reviewing it, and harden XML validation and exported register storage before production use.
references/ksef-troubleshooting.md:448Unpinned Remote Repository Is Cloned and Executed
references/ksef-troubleshooting.md:460Untrusted XML Is Parsed Without Explicit Entity and Resource Restrictions
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Endpoint:
DELETE /api/online/Session/Terminate
Authorization: SessionToken {token}
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<SystemInfo>Autonomous KSeF Agent v2.1</SystemInfo>
</Naglowek>
<!-- Sprzedawca -->
<Podmiot1>
<DaneIdentyfikacyjne>
<NIP>1234567890</NIP>
The workflow explicitly allows AI-based cost classification to trigger automatic booking when confidence exceeds 0.8, with direct persistence to the database and no mandatory human verification or control checks. In an accounting/KSeF context, misclassification can create incorrect VAT treatment, wrong ledger postings, and compliance/reporting errors that may propagate into statutory registers.
The skill content is written entirely in Polish and presents its instructions and examples only in that language, with no indication that users may choose another language or locale. Under the stated policy, a language-specific constraint should either be optional or clearly documented as a justified region-specific requirement.
The authentication examples show bearer-like token handling and certificate-based session initialization without any warning against hardcoding secrets, exposing them in prompts, or logging them. In an agent skill context, users or downstream implementations may copy these examples directly, increasing the risk of credential leakage and unauthorized access to KSeF sessions and invoice data.
The helper is presented as pre-send validation for KSeF, but it only checks encoding, parses XML, and searches for required tags and schema strings using raw substring matching. In an accounting/KSeF context, this can mislead users into believing invoices are compliant when structurally invalid, semantically incorrect, or nonconformant with the official FA(3) XSD, leading to submission failures or compliance errors.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
"""
session = requests.Session()
# 1. Weryfikuj certyfikat (NIGDY verify=False)
session.verify = certifi.where()
# 2. Użyj silnych cipher suites
This manifest uses Polish-only natural-language descriptions for the skill and its configuration, which can amount to a language/locale policy violation when no opt-in or language alternative is provided. The file does not state that the skill is intentionally limited to Polish-speaking users or that the locale restriction is required for compliance, so the constraint is not clearly justified.
The description explicitly says the assistant is 'w jezyku polskim' (in Polish), which is a natural-language locale constraint. The file does not offer an alternative language option or indicate user choice, so it constitutes a locale policy issue under the stated rule.
The sales VAT register export writes taxpayer and invoice data to local Excel files without any warning about data handling, storage location, or access controls. In practice this increases the risk of unintended disclosure of sensitive financial and tax data through insecure endpoints, shared folders, or unencrypted files.
The purchase register export similarly writes supplier, invoice, and classification data to local Excel files without warning users about confidentiality or endpoint security implications. This can expose commercial and tax records if the workstation, filesystem, or sharing workflow is not adequately protected.
This markdown file documents operations that transmit and retrieve invoice data, which can affect user data and privacy. While it explains endpoints and workflows, it does not explicitly warn that invoices and related metadata may contain sensitive financial or personal information and should be handled securely.
This markdown file contains user-facing instructions and examples exclusively in Polish, including headings, warnings, and explanatory text. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The text states that 'KSeF uses Polish time (UTC+1/UTC+2)' as an instruction without any user opt-in or explicit locale-selection mechanism. Because this is a natural-language constraint and the file does not clearly present locale choice, it matches the policy category for language/locale requirements.
No suspicious patterns detected.