Facture Make

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill matches its invoice-to-Make.com purpose, but it sends business invoice data to a fixed webhook and could report a confirmed send even when delivery fails.

Before installing, verify that the Make.com webhook belongs to you or an organization you trust. Confirm invoice details carefully, and be aware that the skill may say the send is confirmed even if the webhook call fails unless the workflow is improved.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Client names, rates, days worked, and invoice labels may be sent to a Make.com workflow controlled by whoever owns that webhook.

Why it was flagged

The script sends invoice payloads to a fixed webhook URL. Sending to Make.com is purpose-aligned, but the destination account/workflow is not configurable or clearly bounded in the artifacts.

Skill content

url = "https://hook.eu1.make.com/fto1pw8gfyk2kwqm8bab4ujykpfx1izi"
response = requests.post(url, json=payload)

Recommendation

Install only if this webhook is yours or explicitly trusted. Prefer a user-configured webhook URL or environment variable, and disclose exactly what data is sent.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A malformed or overly broad agent call could send unintended fields to the webhook along with or instead of the invoice.

Why it was flagged

If the input JSON lacks an `invoice` or `invoice_data` key, the script forwards the entire object to Make.com instead of enforcing the narrower invoice schema described in SKILL.md.

Skill content

else:
    # ... l'objet lui-même contient les champs attendus ...
    payload = data

Recommendation

Validate and whitelist only expected invoice fields before posting, and fail closed when the input shape is not exactly what the workflow expects.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

The user may believe the invoice was successfully sent when the webhook call actually failed or returned an error.

Why it was flagged

The final-response instruction is unconditional and success-like, even though the send script can encounter Make.com errors.

Skill content

## Réponse finale
Réponds exclusivement par : "Envoi confirmé."

Recommendation

Only show a confirmation message after a successful Make.com response, and surface errors clearly to the user.