Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its invoice-verification purpose, but it handles sensitive invoice data, API credentials, and recharge orders with weak disclosure and unsafe defaults.
Install only if you trust the configured backend and understand that invoice text, invoice images, extracted invoice fields, API keys, and account/order data may be sent to it. Prefer HTTPS-only trusted endpoints, avoid implicit or ambiguous use, review batch folders before upload, and do not create recharge orders unless you explicitly intend to accept terms and generate a payment order.
scripts/invoice_service.js:84Sensitive invoice data and bearer credentials are transmitted over configurable plaintext HTTP endpoints
scripts/invoice_service.js:44Application and cipher keys are persisted and disclosed without adequate secret protection
scripts/invoice_service.js:984Recharge order terms are accepted implicitly instead of requiring explicit user consent
The README documents verification of invoice text and images via backend API calls but does not clearly warn that invoice contents are transmitted off-host to a remote service. Invoice data commonly contains sensitive financial and personal information, so lack of disclosure can cause unintentional exfiltration to a backend the user may not fully trust or control.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Verify invoice text with `POST /api/v4/plugin/verify`
- Verify invoice images with `POST /api/v4/plugin/verify`
- Verify all invoice images in a local directory and save JSON result files next to the source directory
- Create recharge orders with `POST /api/v4/plugin/orders`
- Query recharge order status with `GET /api/v4/plugin/orders/{orderNo}`
## Runtime Requirements
The skill invokes a local Node.js script that can use network and environment capabilities, but the manifest does not declare any tool scope or permission boundaries. This weakens reviewability and user consent because the skill can transmit data or access sensitive configuration without explicit disclosure in its declared interface.
The skill instructs users to verify invoice text and local invoice images against a remote service but provides no warning that invoice contents, financial data, and image files will be transmitted off-host. Because invoices commonly contain sensitive personal and business information, this omission can lead to unintended disclosure of confidential data to an external endpoint.
The skill advertises a very broad set of actions and also enables implicit invocation, but it does not define narrow trigger conditions or user-consent boundaries for when those actions should be activated. That creates a real risk of the agent auto-invoking a capability that can query accounts, process local directories, or create recharge orders based on ambiguous user intent, leading to unintended data exposure or unwanted account actions.
The code allows the API base URL to be overridden from config, command-line options, or environment variables, and then sends bearer app keys, device identifiers, invoice content, and images to that endpoint. This can redirect sensitive data and credentials to an attacker-controlled service or enable SSRF-like access to internal/local services, especially because the default transport is plain HTTP rather than HTTPS.
Invoice images and extracted fields such as invoice code, number, date, amount, and check code are assembled and transmitted to a remote verification API, but the code provides no disclosure, consent prompt, or minimization control. Because invoices often contain sensitive financial and business information, silent transmission creates privacy and compliance risk, and becomes more severe if the API base URL is overridden to an untrusted destination.
The script goes beyond invoice verification and includes account/quota inspection, ledger access, and commerce operations such as creating and querying recharge orders. In a skill advertised for invoice verification, this broadens the accessible attack surface and enables unintended financial or account actions if the skill is invoked with untrusted prompts or by a user who does not expect payment-related capabilities.
Batch verification persists per-file results and summaries to disk in the source directory, including verification responses, extracted invoice fields, file paths, and error details, without warning the user. This can leave sensitive financial data and potentially credential-adjacent metadata in predictable local files that may be accessible to other users, backup systems, or later processes.
The README states that directory verification writes JSON files next to the source directory, but it does not clearly warn users that running the command modifies the local filesystem. In a skill context, undocumented write behavior can surprise users, lead to accidental data placement in sensitive directories, and increase operational risk if the command is run on shared or monitored folders.
The README's verification example uses Chinese invoice fields and the overall workflow appears tailored to a specific locale, but the document does not explicitly state that the skill is China-specific or give users a language/locale choice. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy issue.