Security audit

Invoice

Security checks for vulnerabilities and agentic risk

Overview

This invoice skill handles sensitive billing data, but its storage, PDF generation, numbering, and optional sending are coherent with its stated invoicing purpose.

Install only if you are comfortable keeping billing records, client tax IDs, addresses, emails, invoice PDFs, and your payment details in ~/billing. Review client details, invoice numbers, totals, and email recipients before finalizing or sending invoices, because finalized invoice numbers may need correction through a credit note rather than simple deletion.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
| Legal requirements by country | `legal.md` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly defines local storage locations for client and business records, including tax IDs, addresses, billing configuration, and invoice drafts, but does not warn the user that sensitive financial and personally identifiable data will be stored on disk. This can lead users to provide regulated or confidential data without informed consent or appropriate local protection measures, increasing the risk of privacy exposure on shared or insecure systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow includes sending invoices by email, which may transmit sensitive financial and identifying information to external recipients, yet the skill does not explicitly disclose this transmission risk. Without a warning and confirmation step, users may unintentionally expose invoice contents through misaddressed emails, insecure mail handling, or use in environments where outbound transmission is restricted.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The markdown states "When user says "factura a Acme"" as an activation cue, but it does not define whether this is an explicit trigger phrase, an example utterance, or the full scope of when the skill should activate. Without constraints or negative examples, similar everyday Spanish phrasing about invoices could unintentionally invoke the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to create and update persistent client records in index.json without requiring explicit confirmation, authorization checks, or a warning that stored customer data will be modified. In an agent context, this can lead to accidental or prompt-induced changes to billing identities, tax IDs, addresses, or payment terms, causing data integrity issues and potentially misdirected invoices or compliance problems.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file defines activation behavior, so SQP-1 applies. The explicit trigger phrase is specific, but the added "or similar" leaves the invocation scope undefined and could cause unintended activation from loosely related everyday Spanish billing requests without clear boundaries or negative examples.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs collection and storage of client name, tax ID, address, and email in clients/index.json, which is sensitive personal and business data. Without an explicit warning, consent/retention guidance, or storage-protection expectations, users may expose regulated data or store it insecurely, especially in shared agent environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The markdown specifies a destructive/irreversible workflow: once finalized, the invoice number is locked and corrections require issuing a credit note. Although the consequence is noted later, there is no prominent user warning in the skill description before or at the point of finalize action to ensure users understand the irreversible effect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The examples and interaction patterns are written as if the skill expects Spanish utterances, such as "factura a Acme" and "Cambia la dirección de Acme a...", with no indication that other languages are supported or that Spanish is a required locale. This can violate language/locale policy when users are not given a choice or clear opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file contains explicit prompts to ask the user in Spanish (e.g. '¿Necesitas facturación con TicketBAI?' and '¿Facturas a administración pública?') but does not indicate that language should match the user's preference. This can violate a language/locale policy when the skill is used in broader multilingual contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template hardcodes Spanish invoice labels such as 'Fecha', 'Vencimiento', 'CLIENTE', 'Descripción', and payment text, which imposes a specific language/locale in the generated output. The file does not indicate that this is optional, configurable, or limited to a Spain/Spanish-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file uses Spanish-facing document labels and examples such as "Factura", "Fecha", and "Sin valor fiscal" alongside English headings and guidance. Under the policy rule for language/locale, the file presents a fixed mixed-language experience without explicitly giving the user a language option or stating that the skill is intentionally limited to Spanish invoice workflows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.