invoice-merger

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:41 AM UTC
• Version: 1.0.5

Overview

The skill appears to merge invoices as described, but its install instructions run mutable remote packages and it automatically opens generated PDFs, so it should be reviewed before installation.

Install only from a reviewed or pinned version, preferably in a virtual environment or sandbox. Do not let an agent run the dependency installation automatically in a sensitive account, and run the skill only on directories you explicitly choose. Be aware it creates a dated output folder and automatically opens the generated PDFs with the system default app.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Remote Dependencies in Skill Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:62, SKILL.md:70, and SKILL.md:83
Vulnerability Type: Unpinned executable third-party dependencies
Risk Level: Medium

Complete Code Snippet:

text

npx clawhub@latest install cdk1025/invoice-merger

text

npx skills add cdk1025/invoice-merger --path invoice-merger

bash

python -m pip install pypdf Pillow

Technical Analysis

The documented installation process retrieves and potentially executes third-party packages without pinning them to reviewed versions. The @latest selector explicitly resolves to a mutable release, while the skills, pypdf, and Pillow dependencies have no version constraints, lockfile, or integrity hashes.

Consequently, the effective code installed by these commands can change after this skill has been reviewed. The issue could be exploited through a compromised package publisher, malicious future release, registry compromise, dependency confusion, or another supply-chain attack. There is no evidence that the currently referenced packages are malicious; the risk arises from mutable, remotely resolved dependencies.

Attack Path

1. An attacker compromises a referenced package publisher or package-registry release channel.
2. The attacker publishes a malicious version under the package name selected by @latest or by unconstrained dependency resolution.
3. A user or AI agent follows the installation instructions in SKILL.md.
4. The package manager downloads the attacker-controlled version.
5. Package installation hooks or subsequently invoked package code execute under the installing user's account.
6. The payload can access resources available to that account and may modify files or execute additional commands.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the permissions of the user running npx or pip. The accessible scope may include u ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest and all unconstrained package references with exact, reviewed versions.
• Document commands such as npx clawhub@X.Y.Z and npx skills@X.Y.Z, using verified release numbers.
• Define exact Python dependency versions in a committed requirements or lock file.
• Generate and enforce cryptographic hashes for Python packages, for example through a hash-locked requirements file and pip install --require-hashes.
• Commit applicable package-manager lockfiles and verify package integrity metadata.
• Review package publishers, release provenance, and installation scripts before allowing an AI agent to execute installation commands.
• Perform installation in an isolated virtual environment or sandbox with access restricted to the files required by this skill.
• Avoid running package installation as an administrator or root user.

T08 · Insecure Dependencies

Warning

• Location: CLAWHUB.md:30

Finding

Unpinned Remote Dependencies in ClawHub Installation Documentation

Content

View full analysis

Vulnerability Details

File Location: CLAWHUB.md:30, CLAWHUB.md:38, and CLAWHUB.md:51
Vulnerability Type: Unpinned executable third-party dependencies
Risk Level: Medium

Complete Code Snippet:

text

npx clawhub@latest install cdk1025/invoice-merger

text

npx skills add cdk1025/invoice-merger --path invoice-merger

bash

python -m pip install pypdf Pillow

Technical Analysis

The ClawHub documentation instructs users and agents to obtain executable dependencies from external package registries without exact version constraints or integrity verification. In particular, clawhub@latest intentionally selects whichever release is current at execution time. The other npm and Python package references are similarly unconstrained.

This prevents the audited repository from defining the precise code that will be installed. A future malicious release or compromised registry account could therefore introduce arbitrary behavior without requiring any modification to this repository. No malicious behavior in the current project or evidence of a presently compromised dependency was identified.

Attack Path

1. An attacker gains control of a referenced npm or Python package release channel.
2. The attacker publishes a malicious version that satisfies the mutable installation command.
3. A user or AI agent executes one of the documented commands.
4. npm or pip resolves and downloads the malicious version.
5. Installation-time hooks or later package execution run the payload with the invoking user's permissions.
6. The payload can read or modify resources available to that user and potentially retrieve or execute further components.

Impact Assessment

Exploitation could result in arbitrary code execution in the installation environment. The attacker could access user-readable data, modify user-writable files, steal credentials exposed to the process, or compromise projects ...[truncated 232 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each npm and Python dependency to an exact reviewed version.
• Remove the @latest selector from installation instructions.
• Provide committed lockfiles and integrity data for all supported package managers.
• Supply a hash-locked Python requirements file and instruct users to install it with hash verification enabled.
• Use package provenance or signature verification where the relevant registry supports it.
• Test and review dependency updates before changing pinned versions.
• Recommend installation in a least-privileged virtual environment, container, or equivalent sandbox.
• Ensure AI agents request confirmation before downloading and executing remotely sourced packages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation states that the tool outputs merged files into a dated directory, but it does not prominently warn users that running the skill changes the filesystem and may create new files automatically. In an agent context, undisclosed write behavior can lead to unexpected modifications and user surprise, especially if the skill is triggered too easily.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The documentation instructs users to run npx clawhub@latest install ..., which fetches and executes the latest package version at install time. Using an unpinned version increases supply-chain risk because a compromised or breaking upstream release could execute unexpected code on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The command npx skills add ... invokes a package without an explicitly pinned version, so the installed code may vary over time and could include malicious or unsafe changes if the upstream package is compromised. This creates a supply-chain execution risk because npx downloads and runs code directly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger examples are broad natural-language requests like merging files in a directory, which can cause the agent to activate in ordinary conversations without sufficiently explicit user intent. In a skill that writes files and opens generated output, ambiguous activation increases the chance of unintended filesystem modifications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises shell-capable installation and execution paths but does not declare any explicit tool scope or permissions in its metadata. In an agent ecosystem, missing tool constraints can let the runtime or user assume broader execution is acceptable, increasing the chance that shell commands are invoked without clear review boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Using npx clawhub@latest install cdk1025/invoice-merger pulls and executes the latest remote package version at install time, which is a supply-chain risk. If the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code merely by following the documented install command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Using npx skills add cdk1025/invoice-merger --path invoice-merger without pinning a specific package version creates the same remote-code and supply-chain exposure as other npx-based installers. An attacker controlling or compromising the package resolution path could deliver unexpected code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing documentation and runtime messages entirely in Chinese, starting with the module docstring and continuing throughout the script. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue because users are not given any way to choose another language.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatically launching external applications is not necessary for invoice merging and expands the script's attack surface into whatever program is registered to handle PDFs on the host. In a workflow that processes untrusted invoices, this can increase exposure to malicious PDF content or unexpected application execution through local file associations, even though the script itself is not directly executing arbitrary commands.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/merge_invoices.py (reported line 382)May include surrounding context.

python

for output_file in output_files:
        try:
            if sys.platform == "darwin":
                subprocess.run(["open", str(output_file)], check=False)
            elif sys.platform == "win32":
                os.startfile(str(output_file))
            elif sys.platform.startswith("linux"):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/merge_invoices.py (reported line 386)May include surrounding context.

python

elif sys.platform == "win32":
                os.startfile(str(output_file))
            elif sys.platform.startswith("linux"):
                subprocess.run(["xdg-open", str(output_file)], check=False)
        except Exception as e:
            print(f"⚠ 自动打开失败: {output_file.name}, {e}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill title and usage examples are entirely presented in Chinese, and the invocation examples assume Chinese-language interaction. This can be a natural-language policy concern if organizational policy requires offering language choice rather than implicitly forcing one locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Automatically opening generated files after creation can trigger unintended application launches or side effects through the system's default handler, yet the documentation does not clearly warn users about this behavior. While not inherently malicious, it expands the action scope beyond file generation and may be unsafe in constrained or unattended environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger section lists phrases like "合并发票" and "把发票拼一起" plus a general intent description, but it does not clearly define boundaries for when the skill should or should not activate. Without negative examples or tighter constraints, these phrases could overlap with ordinary conversation about invoices rather than a request to run this specific skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.