Security audit

报销助手

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate reimbursement helper, but it handles sensitive financial documents and can automatically rename, move, and copy files without strong safeguards.

Review this skill before installing. It is not showing exfiltration or persistence abuse, but it should be used only on reimbursement documents you intend to process, preferably in a dedicated folder with backups. Ask for a preview/confirmation workflow and filename sanitization before allowing it to rename, move, or copy financial documents automatically.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/rename_files.py:17
Finding: Path Traversal Through Unsanitized Credential Filename Components
Content: View full analysis
Remediation: View remediation
Path: base = base.resolve() candidate = candidate.resolve() if not candidate.is_relative_to(base): raise ValueError("Destination escapes the permitted directory") return candidate ``` 6. Use a sanitized basename and verify both `renamed_path` and `dst_path` against their respective permitted parent directories. 7. Refuse to replace existing files, or generate collision-resistant names using an explicit and documented policy. 8. Validate `src_path` and ensure that it refers to an expected regular file within an approved input directory. 9. Add security tests for absolute paths, `../` traversal, backslash traversal, nested directory components, unsupported extensions, symlinks, and destination collisions. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly describes automatic renaming and copying/storage of reimbursement evidence, but does not present a clear warning or consent checkpoint before modifying local files. Because the skill handles potentially sensitive financial documents, silent rename/copy behavior can lead to unexpected file changes, misplaced records, privacy exposure, or propagation of incorrectly classified documents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad enough to activate on common finance-related conversation such as '报销' or '发票', which can cause the skill to engage unexpectedly and process sensitive reimbursement documents without sufficiently deliberate user intent. In a skill that handles invoices, travel records, and file operations, accidental activation increases the chance of unintended collection, classification, or modification of personal/corporate financial data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring describes this script as a 'voucher file naming tool' with usage python rename_files.py, which strongly implies execution performs file renaming. However, the __main__ block does not call rename_file and instead invokes generate_report_summary() to read JSON records and print a summary report. This is an active contradiction between the documented intent of the script entrypoint and its actual runtime behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code performs filesystem-changing operations by renaming the original file in place and copying it into another directory. Although the function docstring describes the behavior, the script's actual user-facing execution path only prints a report summary and provides no visible warning, prompt, or disclosure when these destructive/modifying operations are invoked programmatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module docstring presents the skill name and usage entirely in Chinese, which imposes a specific language on users without opt-in or alternative locale support. Under the stated policy, language constraints should be optional or explicitly justified.
Content: No source excerpt is available for this finding.