Agent Accounting

• Outcome: Pass
• Latest audit: Jun 17, 2026 · 8:42 PM UTC
• Version: 0.1.0

Overview

This accounting automation skill is coherent and purpose-aligned, but live OCR and tax-provider integrations can handle sensitive financial data.

Install only if you are comfortable using a bookkeeping tool that may process sensitive invoices and tax data. Keep the default/demo or simulated filing mode until you have verified outputs, provider credentials, and destination URLs; pin and audit dependencies before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises automated tax filing and third-party filing integration as core capabilities, but it does not clearly warn that these actions may transmit sensitive financial/tax data or affect real filing state. In an accounting automation skill, users may reasonably follow the documented workflow against live data, increasing the risk of unintended disclosure, incorrect submissions, or compliance-impacting actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The one-command `python main.py full` flow is presented as a routine quick-start despite covering OCR, accounting, filing, and dashboard generation. Without a safety notice, users may trigger external API calls or create filing/submission artifacts from real data without understanding the operational and regulatory consequences.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes broad, common phrases such as accounting, tax filing, invoice OCR, and report generation that can match ordinary user requests without clearly signaling that an external automation skill will run. In a finance skill, accidental activation is risky because it may process sensitive documents or initiate tax-related actions unexpectedly.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example scenarios use ambiguous everyday phrases like '帮我记一笔账' and '这个月报税' as direct execution cues, which encourages automatic invocation from normal conversational requests. Because the skill can perform OCR, generate filings, and open local artifacts, ambiguous routing materially increases the chance of unintended sensitive operations.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The filing section describes third-party tax service integration and API configuration but does not explicitly warn that tax and accounting records may be transmitted to external providers. For a bookkeeping skill, this omission is significant because transmitted data can include invoices, financial statements, taxpayer identifiers, and filing content subject to legal and confidentiality requirements.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The OCR configuration section instructs users to set API credentials and process invoices through a cloud OCR provider without clearly warning that invoice images and extracted financial data may leave the local environment. In the accounting context, invoices and receipts often contain highly sensitive personal, supplier, pricing, and tax information, making silent external processing risky.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function uploads invoice images/PDFs, which typically contain sensitive financial and personal data, to a third-party OCR provider without any explicit user-facing disclosure or consent mechanism in this code path. In an accounting automation skill, this is more sensitive than generic OCR because documents may contain tax IDs, bank details, addresses, and transaction amounts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The VAT invoice path also transmits document contents to Baidu OCR without an explicit disclosure or opt-in step. Because VAT invoices are especially sensitive in a bookkeeping/tax context, remote transmission increases confidentiality and compliance risk if users are unaware.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module sends highly sensitive taxpayer data, including tax IDs and full XML filing content, to third-party endpoints with no built-in consent, approval, or policy gate. In an accounting/tax automation skill, this is especially risky because the payload contains regulated financial data and can be transmitted to arbitrary configured providers or URLs.

Missing User Warnings

Low

• Confidence: 75% confidence
• Finding: The function exports filing records to an arbitrary file path on disk without any safety checks, encryption, or user confirmation. Even though it writes metadata rather than full XML, the output still contains sensitive tax filing details that could be stored insecurely or written to unintended locations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 以下为可选增强依赖

# HTTP请求（百度OCR/金税四期API调用）
requests>=2.28.0

# 图像处理（上传票据图片前预处理，可选）
Pillow>=9.0.0

• Confidence: 91% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

# 图像处理（上传票据图片前预处理，可选）
Pillow>=9.0.0

# Excel报表导出（可选）
openpyxl>=3.0.10

• Confidence: 95% confidence
• Finding: Pillow>=9.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9.0.0

# Excel报表导出（可选）
openpyxl>=3.0.10

# 环境变量管理（可选，也可直接设置系统环境变量）
python-dotenv>=1.0.0

• Confidence: 90% confidence
• Finding: openpyxl>=3.0.10

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl>=3.0.10

# 环境变量管理（可选，也可直接设置系统环境变量）
python-dotenv>=1.0.0

• Confidence: 84% confidence
• Finding: python-dotenv>=1.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: requests

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: Pillow

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: openpyxl

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 73% confidence
• Finding: python-dotenv

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.