Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Execution | Runs local Python entry points: `scripts/render_invoice.py` and `scripts/render_pdf.py`. |
Security audit
Agentic Invoice Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a local invoice and PDF generator with disclosed file reads and writes, no network or credential behavior, and one optional preview dependency that users should treat cautiously.
Install only if you want a local Python-based invoice document generator. Treat generated invoices as drafts, verify all payment, tax, accounting, and client facts before sending, and avoid optional PNG/logo rendering with untrusted files unless the flagged Pillow pin is updated in your environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Execution | Runs local Python entry points: `scripts/render_invoice.py` and `scripts/render_pdf.py`. |
Known Vulnerable Dependency: pillow==12.2.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The file pins Pillow to a version flagged by the scanner as having multiple known vulnerabilities, including decompression-bomb related image handling issues and a reported command-injection issue in Windows-specific viewer functionality. In this skill, Pillow is used for optional PNG preview generation, so any untrusted image/font/content processing path could expose the host or cause denial of service, and the pinned vulnerable version prevents inheriting upstream fixes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill explicitly states it can read bundled/user-provided inputs and write rendered artifacts, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch means a hosting agent may grant broader file read/write capability than users expect, increasing the chance of unintended access to local files or writes outside intended output locations.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md |---|---| | Payment operations | Does not collect payment, issue payment links, post to ledgers, or call accounting systems. | | Credentials | Does not read banking credentials, accounting credentials, API keys, or CRM tokens. | | System changes | Does not create persistence, escalate privileges, run background services, or perform destructive file operations. | ## Network Boundary
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md |---|---| | Payment operations | Does not collect payment, issue payment links, post to ledgers, or call accounting systems. | | Credentials | Does not read banking credentials, accounting credentials, API keys, or CRM tokens. | | System changes | Does not create persistence, escalate privileges, run background services, or perform destructive file operations. | ## Network Boundary
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script creates parent directories and writes a PDF file to disk, which is a file-write operation covered by the missing-warning rule for code files. While the tool's purpose implies document generation, there is no confirmation or pre-write disclosure at the point of writing to indicate that directories may be created and the target file overwritten.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The montage function creates parent directories and saves a PNG preview file, which is another file-write operation covered by the rule. The post-save print confirms completion, but there is no advance disclosure that enabling --png will write an additional file to the specified path.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code reads a user-specified file from the local filesystem, which is a safety-relevant file access operation under the warning rule for code files. Although the script has a module docstring describing its purpose, there is no nearby user-facing disclosure, prompt, or log indicating that the provided markdown path will be read from disk.
- Content