T09 · Insecure Skill Coding Practices
Error
- Location
scripts/classify_document.py:157- Finding
Arbitrary Command Execution Through an Unquoted Generated Command and eval
- Content
View full analysis
- Remediation
View remediation
Security audit
Accounting Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its accounting OCR purpose, but it includes unsafe command-running guidance and writes untrusted document text into Excel files.
Review before installing. Avoid the README batch workflow that uses eval; run extractor scripts directly with quoted paths or a safe dispatcher. Store outputs only in protected directories, be cautious opening generated spreadsheets from untrusted documents, and prefer pinned dependencies or a locked environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/extract_statement.py:255- Finding
Spreadsheet Formula Injection Through OCR-Controlled Excel Cell Values
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/ocr_utils.py:1- Finding
Runtime Installation of Unpinned Third-Party Dependency Versions
- Content
View full analysis
=3.10" # dependencies = [ # "pdfplumber>=0.10.0", # "Pillow>=10.0.0", # "pytesseract>=0.3.10", # "pdf2image>=1.17.0", # ] # /// ``` Representative metadata in the extraction scripts includes: ```python # dependencies = [ # "openpyxl>=3.1.0", # "pdfplumber>=0.10.0", # "Pillow>=10.0.0", # "pytesseract>=0.3.10", # "pdf2image>=1.17.0", # ] ``` `README.md:47` states: ```text All scripts use PEP 723 inline dependencies, so dependencies are auto-installed with `uv run`. ``` ### Technical Analysis The scripts specify minimum versions with no upper bound and rely on `uv run` to resolve and install dependencies automatically. Therefore, the code executed in a future run may differ from the dependency code that was present or reviewed during this audit. This is not evidence that the currently named packages are malicious. The security concern is that broad `>=` constraints and runtime resolution permit future releases—including a compromised, malicious, or incompatible release—to enter the execution environment without a corresponding review of the Skill. The risk applies to all scripts containing these PEP 723 declarations, including the Excel-generation dependency on `openpyxl`. ### Attack Path 1. A future package release satisfying one of the broad minimum-version constraints is published. 2. The release is compromised, malicious, or contains a newly introduced exploitable vulnerability. 3. A user invokes a script with `uv run` in an environment where that version is selected. 4. `uv` downloads and installs the selected dependency. 5. The package is imported by the Skill and its code executes ...[truncated 767 chars]- Remediation
View remediation
=` constraints. 2. Generate and commit a lockfile that records complete transitive dependency versions. 3. Use package hashes or another integrity-verification mechanism where supported. 4. Configure `uv` to use an explicitly trusted package index. 5. Resolve and install dependencies during a controlled deployment step instead of implicitly changing the environment whenever a document is processed. 6. Use automated dependency scanning and a reviewed update process for version changes. 7. Run document processing in a restricted environment with limited filesystem access, no unnecessary credentials, and network access disabled unless required. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/ocr_utils.py:138- Finding
Sensitive OCR Temporary Images Are Not Reliably Deleted After Exceptions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code accurately supports part of the description: extracting invoice data from PDF/JPG/PNG with OCR, producing Excel and JSON outputs, and handling Vietnamese/international invoice patterns. However, the declared purpose presents a broader multi-document system covering invoices, purchase orders, and bank statements, plus classification and routing of unknown documents. This code chunk only implements invoice extraction and related tracking/validation. Because key declared capabilities are absent from the actual behavior, the description does not accurately represent this specific supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This code aligns with part of the description: it extracts structured data from PDF/image files using OCR-related utilities, writes Excel tracking data, saves JSON backups, and supports Vietnamese/English-style PO field labels. However, the declared description is materially broader than the code shown. The actual primary purpose of this chunk is specifically purchase-order extraction and tracking, not general accounting document processing. There is no evidence here of invoice handling, bank statement handling, unknown-document classification, or routing to other extractors. Duplicate detection and delivery-date urgency checks are extra PO-tracking features, but they are related supporting behavior rather than problematic undeclared capabilities. Therefore the description does not accurately represent this code chunk as written.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied code is a focused bank-statement extractor. It parses bank/account metadata and transactions from OCR text/tables, writes a bank statement Excel workbook, and saves JSON backups. This aligns with only one subset of the declared description: bank statement extraction from PDF/JPG/PNG with OCR and structured outputs. However, the description materially overstates the skill’s scope by claiming support for invoices, purchase orders, unknown-document classification, and routing to different extractors. Those capabilities are absent from this code chunk. No undeclared dangerous behavior is evident; the mismatch is that the declared purpose is broader than the implemented behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes a full document ingestion and extraction pipeline for accounting records, including OCR, classification, and structured output. The actual code chunk is limited to spreadsheet template generation. While Excel tracking sheets are tangentially related to the declared domain, this code does not implement the core advertised capabilities and instead has a much narrower primary purpose: creating blank accounting Excel templates.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code generally aligns with a narrow subset of the description: it supports OCR/text extraction from digital/scanned PDFs and image files, includes Vietnamese language preference, and has minor utilities for cleaning amounts and parsing dates. However, the declared purpose claims a broader end-to-end accounting document processor that handles invoices, purchase orders, and bank statements, extracts structured data, classifies unknown documents, routes them to the correct extractor, and outputs Excel tracking sheets and JSON backups. None of those higher-level document-specific processing, classification, routing, or Excel-generation behaviors are present in this code chunk. The code is best described as an OCR helper module, not the full described skill. Therefore this is a material description-behavior mismatch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README encourages writing Excel tracking sheets and JSON backups containing invoice, vendor, tax, and bank data but does not clearly warn that these outputs contain sensitive financial information. This can lead to insecure storage, accidental sharing, or retention of regulated business data, especially because JSON backups duplicate the extracted contents.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The batch-processing example parses a command string from classifier output and executes it with
eval, which allows arbitrary shell execution if the classifier output is ever influenced by untrusted document content or modified script behavior. In this skill, documents are untrusted inputs and the classifier is explicitly routing based on those inputs, so turning its output into shell code materially increases risk beyond normal document extraction.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The batch example not only uses
evalon generated commands, but does so without any warning that the generated string must be treated as untrusted. This normalizes unsafe execution patterns and makes command injection more likely in real deployments.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents shell execution and file-writing behavior but does not declare an explicit tool scope such as allowed tools or permissions. That omission weakens governance and increases the chance an agent can invoke shell commands or write files without clear user-visible constraints, especially in a skill that processes sensitive accounting data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill processes invoices, purchase orders, and bank statements and writes Excel and JSON outputs, but it does not prominently warn that these artifacts may contain highly sensitive financial and personal data. In an agent setting, this increases the risk of accidental persistence of confidential data in insecure locations or unintended sharing of backups.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian
bash sudo apt install tesseract-ocr tesseract-ocr-vie poppler-utilsmacOS (Homebrew)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian
bash sudo apt install tesseract-ocr tesseract-ocr-vie poppler-utilsmacOS (Homebrew)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian
bash sudo apt install tesseract-ocr tesseract-ocr-vie poppler-utilsmacOS (Homebrew)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian
bash sudo apt install tesseract-ocr tesseract-ocr-vie poppler-utilsmacOS (Homebrew)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian
bash sudo apt install tesseract-ocr tesseract-ocr-vie poppler-utilsmacOS (Homebrew)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu / Debian
bash sudo apt install tesseract-ocr tesseract-ocr-vie poppler-utilsmacOS (Homebrew)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The guide marks the Vietnamese language pack as "critical for hóa đơn," which imposes a locale-specific assumption in natural language. The file does not indicate that Vietnamese is optional, user-selected, or that this skill is explicitly limited to a Vietnam-specific accounting context.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python | Problem | Solution | |---------|----------| | "tesseract is not installed" | `sudo apt install tesseract-ocr` | | Vietnamese text garbled | `sudo apt install tesseract-ocr-vie` | | "poppler-utils not installed" | `sudo apt install poppler-utils` | | Low confidence on clean PDF | Likely a digital PDF — pdfplumber should work fine |
Static analysis
No suspicious patterns detected.