Invoice Generator Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:28 PM UTC
• Version: 1.0.0

Overview

The skill is a straightforward invoice generator, but unsafe handling of invoice fields can let untrusted input alter generated invoices or active HTML output.

Review before installing. This skill appears locally scoped and not malicious, but use it only with trusted invoice data, avoid HTML output from untrusted client or item fields, and prefer a fixed version that escapes HTML and validates numeric inputs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: generate-invoice.sh:55
• Finding: Stored HTML and Script Injection in Generated Invoices<![CDATA[ ## Vulnerability Details **File Location**: `generate-invoice.sh:55-56`, `generate-invoice.sh:70-82`; injection sinks in `template.html:6`, `template.html:40-42`, `template.html:49`, `template.html:54-55`, and `template.html:62-64` **Vulnerability Type**: Unescaped HTML injection **Risk Level**: High ### Vulnerable Code ```bash ITEM_ROWS_HTML+=" <tr><td>${desc}</td><td>${qty}</td><td>${rate_fmt}</td><td>${amt_fmt}</td></tr>\n" ITEM_ROWS_MD+="| ${desc} | ${qty} | ${rate_fmt} | ${amt_fmt} |\n" ``` ```bash TPL=$(cat "$SCRIPT_DIR/template.html") TPL="${TPL//\{\{INVOICE_NUMBER\}\}/$INVOICE_NUMBER}" TPL="${TPL//\{\{DATE\}\}/$DATE}" TPL="${TPL//\{\{DUE_DATE\}\}/$DUE}" TPL="${TPL//\{\{FROM\}\}/$FROM}" TPL="${TPL//\{\{CLIENT\}\}/$CLIENT}" TPL="${TPL//\{\{CLIENT_EMAIL\}\}/$CLIENT_EMAIL}" TPL="${TPL//\{\{CURRENCY\}\}/$CURRENCY}" TPL="${TPL//\{\{SUBTOTAL\}\}/$SUBTOTAL}" TPL="${TPL//\{\{TAX_RATE\}\}/$TAX}" TPL="${TPL//\{\{TAX_AMOUNT\}\}/$TAX_AMOUNT}" TPL="${TPL//\{\{TOTAL\}\}/$TOTAL}" ROWS=$(echo -e "$ITEM_ROWS_HTML") TPL="${TPL//\{\{ITEMS_ROWS\}\}/$ROWS}" ``` Representative template sinks include: ```html <title>Invoice {{INVOICE_NUMBER}}</title> ``` ```html <div><strong>{{INVOICE_NUMBER}}</strong></div> <div>Date: {{DATE}}</div> <div>Due: {{DUE_DATE}}</div> ``` ```html <div>{{FROM}}</div> <div>{{CLIENT}}</div> <div>{{CLIENT_EMAIL}}</div> ``` ```html <tbody> {{ITEMS_ROWS}} </tbody> ``` ### Technical Analysis The command-line fields are treated as trusted HTML and substituted directly into the template. No HTML encoding is performed for client names, email addresses, invoice identifiers, dates, sender names, currency values, or item descriptions. An attacker can therefore close the surrounding HTML element and insert arbitrary markup or active content. For example, a crafted client or item description could contain a `<script>` element, an element with an event handler, an external tracking resource, or deceptive invoice markup. Because this paylo ...[truncated 1595 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a dedicated HTML-encoding function that replaces at least: - `&` with `&amp;` - `<` with `&lt;` - `>` with `&gt;` - `"` with `&quot;` - `'` with `&#39;` 2. Encode every user-controlled text field before inserting it into the template, including item descriptions and all invoice metadata. 3. Prefer a template engine that performs automatic context-aware escaping rather than Bash string substitution. 4. Do not attempt to secure the output through blacklist filtering; encode data according to its HTML context. 5. Consider applying a restrictive Content Security Policy to generated documents as defense in depth, while recognizing that CSP does not replace output encoding. 6. Replace `echo -e` with `printf '%s'` so backslash sequences in generated content are not interpreted unexpectedly. 7. Add security tests using script tags, event-handler attributes, malformed closing tags, quotes, ampersands, multiline input, and external resource elements. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: generate-invoice.sh:50
• Finding: Unvalidated User Input Evaluated as bc Program Source<![CDATA[ ## Vulnerability Details **File Location**: `generate-invoice.sh:50-60` **Vulnerability Type**: Arithmetic expression injection and denial of service **Risk Level**: Medium ### Vulnerable Code ```bash for item in "${ITEMS[@]}"; do IFS='|' read -r desc qty rate <<< "$item" amount=$(echo "$qty * $rate" | bc) SUBTOTAL=$(echo "$SUBTOTAL + $amount" | bc) amt_fmt=$(printf "%.2f" "$amount") rate_fmt=$(printf "%.2f" "$rate") ITEM_ROWS_HTML+=" <tr><td>${desc}</td><td>${qty}</td><td>${rate_fmt}</td><td>${amt_fmt}</td></tr>\n" ITEM_ROWS_MD+="| ${desc} | ${qty} | ${rate_fmt} | ${amt_fmt} |\n" done TAX_AMOUNT=$(printf "%.2f" "$(echo "$SUBTOTAL * $TAX / 100" | bc -l)") TOTAL=$(printf "%.2f" "$(echo "$SUBTOTAL + $TAX_AMOUNT" | bc -l)") ``` ### Technical Analysis The `qty`, `rate`, and `tax` fields are accepted without validating that they contain only permitted numeric syntax. These values are interpolated into strings and passed to `bc`, where the resulting text is parsed as program source rather than as isolated numeric data. An attacker can introduce operators, separators, function definitions, multiline statements, or computationally expensive expressions. This can alter invoice calculations, cause parsing failures, terminate generation under `set -e`, or consume excessive CPU and memory. The shown code does not invoke a shell with these expressions, so this issue should not be treated as direct shell-command injection. Its primary scope is manipulation of the `bc` interpreter and the invoice-generation process. Any additional effects would depend on nonstandard capabilities of the installed `bc` implementation. ### Attack Path 1. An attacker supplies or influences the quantity or rate component of an `--item` argument, or the value passed through `--tax`. 2. The attacker provides an expression instead of a simple decimal number. 3. The script concatenates that input into a `bc` program. 4. `bc` parses and evaluates the injected expre ...[truncated 784 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `qty`, `rate`, and `tax` before any arithmetic operation. For non-negative decimal values, use a strict allowlist such as: ```bash is_decimal() { [[ $1 =~ ^[0-9]+([.][0-9]+)?$ ]] } ``` 2. Reject empty values, signs or operators not explicitly supported, newlines, statement separators, exponent syntax, and all other `bc` language constructs. 3. Apply reasonable maximum lengths and numeric bounds to prevent extremely large values from exhausting resources. 4. Validate the `--item` structure and require exactly three non-empty fields. 5. Where possible, use a numeric implementation or API that receives numbers as data rather than concatenating them into interpreter source. 6. Return a clear validation error before calculation instead of relying on `bc` or `printf` to reject malformed input. 7. Add tests for operators, semicolons, newlines, function definitions, very large numbers, excessive decimal precision, missing item fields, negative values, and division or exponent expressions. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

• Category: analysis-evasion

Content

./generate-invoice.sh \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./generate-invoice.sh \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./generate-invoice.sh \

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The out() helper performs a file write with shell redirection when --output is provided, which can overwrite an existing file. Although it prints a message after writing, there is no pre-write warning, confirmation prompt, or inline comment/docstring disclosing the overwrite behavior in the script itself.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The HTML root sets `lang="en"`, which enforces an English-language locale in the rendered document. Under the policy, locale-specific behavior should either be optional or clearly justified; this template does not indicate any opt-in or region-specific constraint.

Static analysis

No suspicious patterns detected.