Security audit

Invoice Generator Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward invoice generator, but unsafe handling of invoice fields can let untrusted input alter generated invoices or active HTML output.

Review before installing. This skill appears locally scoped and not malicious, but use it only with trusted invoice data, avoid HTML output from untrusted client or item fields, and prefer a fixed version that escapes HTML and validates numeric inputs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: generate-invoice.sh:55
Finding: Stored HTML and Script Injection in Generated Invoices
Content: View full analysis
${desc}${qty}${rate_fmt}${amt_fmt}\n" ITEM_ROWS_MD+="| ${desc} | ${qty} | ${rate_fmt} | ${amt_fmt} |\n" ``` ```bash TPL=$(cat "$SCRIPT_DIR/template.html") TPL="${TPL//\{\{INVOICE_NUMBER\}\}/$INVOICE_NUMBER}" TPL="${TPL//\{\{DATE\}\}/$DATE}" TPL="${TPL//\{\{DUE_DATE\}\}/$DUE}" TPL="${TPL//\{\{FROM\}\}/$FROM}" TPL="${TPL//\{\{CLIENT\}\}/$CLIENT}" TPL="${TPL//\{\{CLIENT_EMAIL\}\}/$CLIENT_EMAIL}" TPL="${TPL//\{\{CURRENCY\}\}/$CURRENCY}" TPL="${TPL//\{\{SUBTOTAL\}\}/$SUBTOTAL}" TPL="${TPL//\{\{TAX_RATE\}\}/$TAX}" TPL="${TPL//\{\{TAX_AMOUNT\}\}/$TAX_AMOUNT}" TPL="${TPL//\{\{TOTAL\}\}/$TOTAL}" ROWS=$(echo -e "$ITEM_ROWS_HTML") TPL="${TPL//\{\{ITEMS_ROWS\}\}/$ROWS}" ``` Representative template sinks include: ```html Invoice {{INVOICE_NUMBER}} ``` ```html
{{INVOICE_NUMBER}}

Date: {{DATE}}

Due: {{DUE_DATE}}
``` ```html
{{FROM}}

{{CLIENT}}

{{CLIENT_EMAIL}}
``` ```html {{ITEMS_ROWS}} ``` ### Technical Analysis The command-line fields are treated as trusted HTML and substituted directly into the template. No HTML encoding is performed for client names, email addresses, invoice identifiers, dates, sender names, currency values, or item descriptions. An attacker can therefore close the surrounding HTML element and insert arbitrary markup or active content. For example, a crafted client or item description could contain a `
Remediation: View remediation
` with `>` - `"` with `"` - `'` with `'` 2. Encode every user-controlled text field before inserting it into the template, including item descriptions and all invoice metadata. 3. Prefer a template engine that performs automatic context-aware escaping rather than Bash string substitution. 4. Do not attempt to secure the output through blacklist filtering; encode data according to its HTML context. 5. Consider applying a restrictive Content Security Policy to generated documents as defense in depth, while recognizing that CSP does not replace output encoding. 6. Replace `echo -e` with `printf '%s'` so backslash sequences in generated content are not interpreted unexpectedly. 7. Add security tests using script tags, event-handler attributes, malformed closing tags, quotes, ampersands, multiline input, and external resource elements. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: generate-invoice.sh:50
Finding: Unvalidated User Input Evaluated as bc Program Source
Content: View full analysis
${desc}${qty}${rate_fmt}${amt_fmt}\n" ITEM_ROWS_MD+="| ${desc} | ${qty} | ${rate_fmt} | ${amt_fmt} |\n" done TAX_AMOUNT=$(printf "%.2f" "$(echo "$SUBTOTAL * $TAX / 100" | bc -l)") TOTAL=$(printf "%.2f" "$(echo "$SUBTOTAL + $TAX_AMOUNT" | bc -l)") ``` ### Technical Analysis The `qty`, `rate`, and `tax` fields are accepted without validating that they contain only permitted numeric syntax. These values are interpolated into strings and passed to `bc`, where the resulting text is parsed as program source rather than as isolated numeric data. An attacker can introduce operators, separators, function definitions, multiline statements, or computationally expensive expressions. This can alter invoice calculations, cause parsing failures, terminate generation under `set -e`, or consume excessive CPU and memory. The shown code does not invoke a shell with these expressions, so this issue should not be treated as direct shell-command injection. Its primary scope is manipulation of the `bc` interpreter and the invoice-generation process. Any additional effects would depend on nonstandard capabilities of the installed `bc` implementation. ### Attack Path 1. An attacker supplies or influences the quantity or rate component of an `--item` argument, or the value passed through `--tax`. 2. The attacker provides an expression instead of a simple decimal number. 3. The script concatenates that input into a `bc` program. 4. `bc` parses and evaluates the injected expre ...[truncated 784 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
./generate-invoice.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
./generate-invoice.sh \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
./generate-invoice.sh \

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The out() helper performs a file write with shell redirection when --output is provided, which can overwrite an existing file. Although it prints a message after writing, there is no pre-write warning, confirmation prompt, or inline comment/docstring disclosing the overwrite behavior in the script itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The HTML root sets lang="en", which enforces an English-language locale in the rendered document. Under the policy, locale-specific behavior should either be optional or clearly justified; this template does not indicate any opt-in or region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.