Security audit

receipt-compliance

Security checks across malware telemetry and agentic risk

Overview

This accounting skill is mostly purpose-aligned, but it needs review because it repeatedly claims local-only handling while configured verification and approval features can send sensitive invoice or reimbursement data to external services and create persistent archives.

Install only if you are comfortable with a finance workflow that reads and stores sensitive invoice, reimbursement, and bank-statement data. Before use, decide which external verification or approval services are allowed, keep API keys in environment variables, require human review before submitting approvals, and store generated JSON/XLSX/ZIP outputs in access-controlled locations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents capabilities to read/write files, access environment variables, perform network calls, and invoke shell commands, yet no explicit permissions are declared. This creates a trust and containment gap: users and host platforms cannot accurately understand or constrain what the skill can do before use.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The top-level description presents a narrower accounting/OCR helper, while the document describes substantially broader behavior including bank reconciliation, voucher generation, archival packaging, risk analytics, installation scripts, and external service integration. This mismatch can mislead users into granting trust or supplying sensitive financial data without realizing the full processing and exposure surface.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest emphasizes local-only processing, but later functionality includes external verification and approval workflows that necessarily transmit invoice or reimbursement metadata to third-party platforms. Misrepresenting data-flow boundaries can cause users to expose sensitive financial information under false privacy assumptions.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The documentation claims invoice data is never sent externally, yet the same file describes API-based verification and approval submission to tax and enterprise platforms. For invoices and reimbursement records, even limited fields can contain sensitive financial and organizational data, so this contradiction materially increases privacy and compliance risk.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill makes strong security/privacy assurances that conflict with later documented behaviors involving browser opening, tax-platform verification, and approval API submission. Contradictory security claims can lead users to underestimate the risk of sharing invoice, employee, and reimbursement data with external systems.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The skill metadata claims data is processed locally, but initializing PaddleOCR can implicitly download model files or contact external endpoints on first run depending on environment and package state. For invoice OCR, this can violate deployment assumptions, create unexpected outbound network access, and undermine privacy/compliance guarantees even if no invoice image is directly uploaded by this code path.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The code promises a strict business control ('勾稽不过不入库') but only sets review flags and still returns apparently successful structured data. In financial workflows, downstream systems may ignore optional review markers and ingest untrusted or inconsistent invoice data, enabling fraud, reimbursement errors, or policy bypass.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The fallback helper explicitly recommends an external online OFD-to-PDF conversion service even though the skill claims enterprise-local data processing. In this receipt/invoice compliance context, OFD files may contain sensitive financial, tax, and personal data, so encouraging upload to a third-party service creates a real risk of unintended data exfiltration and policy noncompliance.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill metadata says data is processed locally, but the CustomEngine explicitly serializes invoice fields and sends them to a configurable remote endpoint via HTTP(S). Invoice data often contains sensitive financial and personal information, so this creates a clear data exposure and transparency problem, especially if operators assume no external transmission occurs.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The TaxBureauEngine is presented as a verification engine, but it does not perform authenticity verification and only returns instructions for manual checking. This can mislead downstream systems or users into believing an automated trust check occurred when no verification was actually performed, creating integrity and workflow bypass risk.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger guidance encourages broad natural-language activation for sensitive operations such as OCR, verification, report generation, and approval submission. Without narrow intent boundaries or confirmation checkpoints, ordinary conversation could unintentionally initiate actions on sensitive files or business workflows.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Suggested phrases like '发起审批' or '提交报销审批' overlap with normal workplace language and lack exclusion rules, making accidental invocation more plausible. In a finance context, accidental execution can expose invoice data, create records, or trigger approval actions with real operational consequences.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Automatically inferring intent from uploaded files or file paths without clear limits increases the chance of processing the wrong document set or taking an unintended action. In this skill's context, uploaded files may include invoices, bank statements, or reimbursement templates containing sensitive enterprise data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example shows extracting detailed invoice data and writing it to a JSON file, including company names, amounts, dates, and invoice identifiers, but provides no warning about sensitive financial data handling, storage, access control, retention, or redaction. In a receipt-compliance skill, this omission increases the risk that users will store regulated or confidential accounting data insecurely, especially on local disk paths that may be broadly accessible or synced.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill processes invoices, seller names, amounts, tax data, and reimbursement details, all of which may contain sensitive financial or company information. The example lacks any privacy notice, handling guidance, or data-retention explanation, which can lead users to expose regulated or confidential business data without understanding storage, sharing, or logging implications.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The DingTalk submission flow sends applicant identifiers and expense details to an external SaaS API without any explicit consent, notice, or policy gate in this component. In an enterprise finance context, these fields can contain personal and sensitive business data, so silent transmission increases privacy, compliance, and data-governance risk, especially given the skill description's emphasis on local processing.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The WeCom flow transmits approval content and user identity data to an external service without an explicit user-facing disclosure or confirmation mechanism in the code path. Because this skill handles reimbursement workflows, the transmitted data may include employee identifiers and financial information, making undisclosed external transfer a meaningful privacy/compliance issue.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code creates persistent ZIP archives containing structured invoice metadata and original invoice files, which are highly sensitive financial records. Because this happens without an explicit user confirmation step, retention control, encryption, or prominent warning, users may unintentionally leave sensitive local archives on disk where they can be accessed by other local users, backup systems, or downstream processes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code sends invoice code, number, date, and amount to an externally configured endpoint without any user-facing notice, confirmation, or policy enforcement in the execution path. In an accounting/compliance skill, these records are sensitive business data, so silent transmission increases privacy, compliance, and third-party data handling risks.

Missing User Warnings

Medium

Confidence: 71% confidence
Finding: The script writes invoice verification results, including invoice identifiers, date, and amount, to an arbitrary output path without any privacy warning, sensitivity labeling, or permission hardening. In an accounting context, these records may contain financial data that can be inadvertently persisted to shared locations, backups, or world-readable paths, increasing the risk of unauthorized disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/setup-guide.md:77

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:759

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: templates/config_template.yaml:17