Emissor de Nota Fiscal Paulistana

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

This NFS-e skill mostly matches its invoicing purpose, but it handles certificate-backed tax actions with under-scoped email disclosure, plaintext retained data, and unsafe XML construction.

Review this skill carefully before installing. It can issue and cancel real São Paulo service invoices using your certificate, store client and fiscal records locally, and send invoice links by email. Only use it with non-production data until XML escaping, response logging, secret storage, and explicit confirmation for every email and production action are fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: emitir_nfse.py:285

Finding

Unsigned user input is interpolated into XML before privileged signing and transmission

Content

View full analysis

{config['cnpj_prestador']} false {nota['data_emissao']} {nota['data_emissao']} 1 {formata_valor(nota['valor_servicos'])} {formata_valor(nota.get('valor_deducoes', 0))} {assinatura_rps} {config['inscricao_municipal']} {config['serie_rps']} {nota['numero_rps']} RPS {nota['data_emissao']} {nota['status_rps']} {config['tributacao_rps']} {formata_valor(nota['valor_servicos'])} {formata_valor(nota.get('valor_deducoes', 0))} {f"{formata_valor(v_pis)}" if v_pis > 0 else ""} {f"{formata_valor(v_cofins)}" if v_cofins > 0 else ""} {f"{formata_valor(v_inss)}" if v_inss > ...[truncated 4112 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: emitir_nfse.py:456

Finding

Production SOAP responses are retained in predictable plaintext files

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:53

Finding

The Skill mandates an additional email disclosure without transaction-specific consent

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tainted flow: 'xml_consulta' from os.environ.get (line 95, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · baixar_notas.py (reported line 117)May include surrounding context.

python

temp_cert_path = temp_cert.name

    try:
        response = requests.post(
            url,
            data=xml_consulta.encode('utf-8'),
            headers=headers,

Tainted flow: 'envelope_soap' from os.environ.get (line 80, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · consulta_rps.py (reported line 104)May include surrounding context.

python

try:
        print("Consultando API da prefeitura...")
        response = requests.post(url, data=envelope_soap.encode('utf-8'), headers=headers, cert=temp_cert_path, timeout=30)
        print("Status code:", response.status_code)
        
        with open("resposta_consulta.xml", "w") as f:

Tainted flow: 'envelope_soap' from os.environ.get (line 422, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · emitir_nfse.py (reported line 444)May include surrounding context.

python

temp_cert_path = temp_cert.name

    try:
        response = requests.post(
            url,
            data=envelope_soap.encode('utf-8'),
            headers=headers,

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to provide sensitive organizational identifiers such as CNPJ and municipal registration directly in chat, but provides no clear privacy notice, retention policy, or warning about exposure in logs/history. In an invoicing skill, those identifiers are operationally sensitive and their casual collection through chat increases the risk of leakage, misuse, and unintended storage.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The statement that the AI will 'read hidden restrictions and passwords' and then return results in chat normalizes secret access by the model and suggests passwords are part of ordinary conversational processing. That is dangerous because it trains users to expect and accept secret retrieval through the assistant, increasing the chance of credential exposure, overbroad secret access, and unsafe agent behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims issuance/cancellation, but the described ecosystem also includes consultation/querying of issued NFS-e records and local output of retrieved data. Undisclosed query and storage behavior can expose historical invoice data and creates a broader confidentiality risk than users may expect from the stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims issuance/cancellation, but the described ecosystem also includes consultation/querying of issued NFS-e records and local output of retrieved data. Undisclosed query and storage behavior can expose historical invoice data and creates a broader confidentiality risk than users may expect from the stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims issuance/cancellation, but the described ecosystem also includes consultation/querying of issued NFS-e records and local output of retrieved data. Undisclosed query and storage behavior can expose historical invoice data and creates a broader confidentiality risk than users may expect from the stated purpose.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The setup flow instructs the agent to facilitate storing the certificate password in a local .env file as part of a chat-driven process. Handling certificate secrets in this way is highly sensitive: it normalizes plaintext local secret storage, risks accidental disclosure through tooling or repository sync, and ties a production financial credential to a loosely controlled workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code writes the private key and certificate to a temporary PEM file on disk, increasing exposure of highly sensitive key material. Even though the file is later deleted, the key may be accessible to other local processes depending on host configuration, may persist in backups or forensic artifacts, and will remain on disk if the process crashes before cleanup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description limits the skill to issuance and cancellation of NFS-e in São Paulo, but the public webservice interface also exposes multiple consultation operations, including lote status, lote contents, NFS-e by RPS, direct NFS-e lookup, and service-prestado/service-tomado queries. Those are materially broader business capabilities than mere emissão e cancelamento, not just internal implementation details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration turns on ConsultarSituacao, ConsultarLote, ConsultarRps, ConsultarNfse, ConsultarServicoPrestado, and ConsultarServicoTomado in addition to sending and canceling invoices. This confirms the skill's intended runtime behavior includes retrieval and reporting functions that exceed the manifest's narrower description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code saves generated RPS XML locally via SalvarXmlRps, and later persists returned NFSe XML via SalvarXmlNfse in several handlers, which can store sensitive fiscal and identity data on disk. There is no visible user-facing notice, confirmation, or explanatory comment in this file indicating that invoice documents will be written to local storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code constructs and submits a cancellation request for an NFSe, which is a potentially irreversible business action. Although the code includes technical comments about transaction batching semantics, it does not provide any user-facing confirmation or disclosure warning that a fiscal document cancellation will be executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code sends XML payloads containing invoice, CNPJ/CPF, municipal registration, and related fiscal data to remote prefeitura webservice endpoints across multiple methods. The file contains no user-facing confirmation, logging/print disclosure, or explanatory comments warning that sensitive fiscal data will be transmitted over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The entire skill documentation and all example interactions are written as if the user must operate in Portuguese, with no mention of language options or opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README expands the skill from invoice issuance/cancellation into an onboarding workflow that collects business identifiers in chat and writes configuration 'behind the scenes'. That is a meaningful scope expansion because users may invoke an invoicing skill without realizing it will gather and persist sensitive setup data, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad, natural-language prompts like 'Emita uma Nota' or 'Preciso testar a skill', which can cause accidental invocation during ordinary conversation. In a financial/government-service context, unintended activation can lead to collection of sensitive data or initiation of invoice-related actions without clear user intent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Telling users to submit sensitive organizational identifiers directly in chat normalizes use of the conversational channel for secret or regulated setup data. Chat systems commonly retain history, logs, and transcripts, so this creates avoidable exposure of business identifiers during onboarding.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documents capabilities to read environment variables, read and write local files, and access external services, but it declares no explicit tool scope or permission boundaries. In a financial workflow that touches certificate material, customer records, and outbound email/reporting, this lack of scoping materially increases the risk of unintended data access, silent file modification, and exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation trigger covers 'any financial action' on first use or when something appears missing, which is overly broad and ambiguous. Broad triggers in a privileged financial skill raise the chance of accidental activation, unnecessary file reads, and setup actions being initiated in contexts the user did not specifically authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs autonomous modification of config.json and .env without an upfront user-facing warning that files will be changed. Unannounced writes are dangerous in any skill, but especially here because they alter financial configuration and secret-handling files, which can affect billing correctness and security posture.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to create or rename a hidden .env file using terminal/file manipulation during setup. Silent creation of secret-bearing hidden files is dangerous because it changes local system state, encourages secret storage, and may bypass user awareness or repository hygiene controls.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to read stored customer records and reuse company/personal details in chat responses, generated payloads, and email workflows without emphasizing data minimization. In a billing context, this can lead to overexposure of client identifiers, addresses, emails, and financial details across multiple outputs and channels.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow requires autonomous email sending via another skill, but that capability is omitted from the skill description. Undisclosed outbound communication is particularly risky in a financial context because it can transmit invoice links or client/accounting data without the user understanding that a cross-skill exfiltration path exists.

Content

No source excerpt is available for this finding.