发票信息整理与清单

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 0.1.1

Overview

This skill handles invoice organization with sensitive local documents, but its file reading, text extraction, and copying behavior are disclosed and aligned with that purpose.

Install this only if you want a Chinese-language invoice reimbursement organizer and are comfortable letting the agent read invoice PDFs and nearby project marker files to prepare reimbursement context. Avoid running it from broad personal or repository roots, and be aware that extracted invoice text may appear in terminal or agent logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill actually traverses parent directories, lists project-root contents, and reads Markdown/README files beyond the supplied invoices, while its description frames it as invoice organization, the mismatch can hide broader data-access behavior from users and reviewers. In this context, the danger is unintended exposure of unrelated project documents and metadata during processing of sensitive reimbursement materials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill actually traverses parent directories, lists project-root contents, and reads Markdown/README files beyond the supplied invoices, while its description frames it as invoice organization, the mismatch can hide broader data-access behavior from users and reviewers. In this context, the danger is unintended exposure of unrelated project documents and metadata during processing of sensitive reimbursement materials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Line L19 describes a mandatory default output style, including Chinese naming/date conventions such as a YYMMDD filename prefix and Chinese-language formatting expectations, but the file provides no indication that users can choose another language or locale. This is a natural-language policy concern because it appears to impose a specific locale/style by default rather than offering opt-in or alternatives.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands (pdftotext, Python scripts) and reads files/project context, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an overbroad execution surface where an agent may use filesystem and shell capabilities without a least-privilege contract, increasing the chance of unintended file access or command execution during invoice processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L016 中的触发词如“整理一下这批发票”“做个报销清单”“出个消费清单”语义较宽，部分表达在日常对话中也可能出现，且未限定必须针对 PDF 发票归档场景。虽然上下文描述了用途，但这里没有给出更严格的触发边界或负例来避免与普通文档整理、清单生成需求混淆。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire guide is written in Chinese and prescribes Chinese output/field handling such as line L11's required date output format, but it does not state that the skill is intentionally limited to Chinese invoices or offer any language/locale opt-in. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and all formatting instructions are written to produce output in Chinese, and there is no indication that the user can choose another language or locale. This creates a natural-language policy issue because it effectively forces a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s instructions and examples are exclusively in Chinese, which imposes a specific language on users or maintainers. Under the policy, language constraints should either be optional for the user or clearly documented as a justified locale-specific requirement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_invoice.py (reported line 17)May include surrounding context.

python

def extract_one(pdf_path: Path) -> str:
    """提取单个 PDF 的文本层，返回纯文本。"""
    result = subprocess.run(
        ["pdftotext", "-layout", str(pdf_path), "-"],
        capture_output=True,
        text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script prints extracted invoice text directly to stdout, which can expose sensitive financial and personal data in terminal scrollback, shell history captures, CI logs, or orchestrator logs. In the context of invoices and travel/expense receipts, this commonly includes names, tax IDs, account details, invoice numbers, and transaction metadata.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

if not shutil.which("pdftotext"):
        print("❌ 缺少依赖: pdftotext (poppler)")
        print("   macOS:   brew install poppler")
        print("   Linux:   sudo apt-get install poppler-utils")
        print("   或改用 legal-ocr / pdf skill 做 OCR")
        raise SystemExit(1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/extract_invoice.py (reported line 50)May include surrounding context.

python

if not shutil.which("pdftotext"):
        print("❌ 缺少依赖: pdftotext (poppler)")
        print("   macOS:   brew install poppler")
        print("   Linux:   sudo apt-get install poppler-utils")
        print("   或改用 legal-ocr / pdf skill 做 OCR")
        raise SystemExit(1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring is entirely in Chinese and describes the skill’s purpose only in that language, and the user-facing CLI description/help text is also Chinese. This imposes a specific language/locale on users without any opt-in or explanation that the tool is intended only for a Chinese-language or region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All printed status, error, and output labels are hardcoded in Chinese, including failure guidance and directory/file headings. Because the file provides no language selection or stated justification for a Chinese-only interface, this is a natural-language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Natural-language strings including the module description, CLI description, and help text are exclusively in Chinese. The file does not indicate that the skill is intentionally region-specific or provide an alternate language option, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.