发票识别

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent invoice OCR/accounting workflow, but it needs review because it can write untrusted OCR data into financial spreadsheets without clear sanitization and uses overly broad triggers.

Review this skill before installing in a finance workflow. It appears purpose-aligned and not malicious, but users should narrow its triggers, require explicit confirmation before ledger updates, validate OCR fields, and sanitize spreadsheet cell values so invoice text cannot become formulas in Excel.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:390

Finding

Spreadsheet Formula Injection Through Unsanitized OCR Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 390–401
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

python

ws[f'A{last_row}'] = invoice_data.get('entry_date', date.today())
ws[f'B{last_row}'] = invoice_data.get('invoice_code')
ws[f'C{last_row}'] = invoice_data.get('invoice_number')
ws[f'D{last_row}'] = invoice_data.get('product_name')
ws[f'E{last_row}'] = invoice_data.get('spec')
ws[f'F{last_row}'] = invoice_data.get('quantity')
ws[f'G{last_row}'] = invoice_data.get('unit_price')
ws[f'H{last_row}'] = invoice_data.get('amount')
ws[f'I{last_row}'] = invoice_data.get('tax_amount')
ws[f'J{last_row}'] = invoice_data.get('total_amount')
ws[f'K{last_row}'] = invoice_data.get('seller_name')
ws[f'L{last_row}'] = invoice_data.get('purchase_order_no')

Technical Analysis

The function writes OCR-derived invoice fields directly into Excel cells without validating their expected types or neutralizing spreadsheet formula prefixes. Text beginning with =, +, -, or @ may be interpreted as a formula by Excel or another spreadsheet client rather than as literal invoice data.

An attacker who controls invoice content could place a formula-like payload in fields such as the product name, specification, seller name, or purchase-order number. If OCR preserves that content, openpyxl stores it in the workbook without a protective literal-text prefix. The payload may then be evaluated when a finance user opens the workbook.

The precise behavior depends on the spreadsheet client and its security configuration. Potential payloads include deceptive formulas, malicious hyperlinks, and formulas that attempt external-data access. There is no evidence in the audited project of direct operating-system command execution; such an outcome would require additional client-specific unsafe features or user interaction.

Attack Path

1. An attacker creates or modifies an invoice image containing formula-prefi ...[truncated 1347 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply centralized sanitization to every untrusted value before writing it to a spreadsheet:

python

def excel_safe(value):
    if isinstance(value, str):
        value = value.strip()
        if value.startswith(("=", "+", "-", "@")):
            return "'" + value
    return value

2. Use the sanitizer for all OCR-derived textual fields:

python

ws[f'D{last_row}'] = excel_safe(invoice_data.get('product_name'))
ws[f'E{last_row}'] = excel_safe(invoice_data.get('spec'))
ws[f'K{last_row}'] = excel_safe(invoice_data.get('seller_name'))
ws[f'L{last_row}'] = excel_safe(invoice_data.get('purchase_order_no'))

3. Enforce field-specific validation:

   • Require invoice codes and numbers to match documented numeric formats.
   • Parse monetary values, quantities, and tax rates into numeric types before writing them.
   • Apply length and character restrictions to names, specifications, and order identifiers.
   • Reject values containing control characters or unexpected formula syntax.

4. Treat all OCR output as untrusted, even if the source resembles an official invoice.

5. Add regression tests covering values beginning with =, +, -, and @, including malicious hyperlinks and external-reference formulas.

6. Document that generated workbooks contain imported content and should be opened with external links, macros, and automatic data updates disabled.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase "invoice" is overly broad and can activate on general conversations about invoices, billing, or customer support that are outside this skill’s intended OCR and accounting scope. This raises the risk of accidental routing to a finance workflow that may request or process sensitive financial data unnecessarily.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "ocr" is extremely generic and likely to match many unrelated user requests about optical character recognition. In an agent ecosystem, this can cause unintended skill activation, exposing invoice-processing logic and potentially causing sensitive document workflows to run in the wrong context.

Content

No source excerpt is available for this finding.