Security audit
Security checks for vulnerabilities and agentic risk
The skill’s invoice automation purpose is coherent, but it needs Review because it can automatically run unverified installers while handling sensitive mailbox, invoice, and business-system credentials.
Before installing, review or replace the installer path: avoid pipe-to-shell commands, pin package versions, and require explicit approval before any dependency installation. Use a dedicated least-privilege mailbox or folder, narrow date/sender filters, confirm ADP data-processing compliance, and store mailbox, cloud, and ERP credentials in an approved secret manager rather than plaintext config where possible.
SKILL.md:135Unverified Remote Installation Scripts Are Executed Directly by a Shell
SKILL.md:127Unpinned Third-Party Components Are Installed Globally
SKILL.md:227Reusable Service Credentials Are Stored in Plaintext Configuration Files
The skill instructs users to run remote shell and PowerShell bootstrap scripts fetched directly from GitHub, including curl ... | bash and irm ... | iex. This is dangerous because it executes unreviewed remote code immediately on the user's machine, creating a direct path to arbitrary code execution and supply-chain compromise.
The | bash pattern is a classic hazardous chaining construct because it streams network content directly into a shell interpreter. In this finance/email-processing skill, that is especially dangerous: compromise of the fetched script could yield immediate arbitrary command execution on systems holding mailbox credentials, invoices, and API tokens.
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli
# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
# Windows (PowerShell)
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex
The README promotes automatic mailbox access and attachment retrieval without clearly warning that the skill may access large volumes of sensitive email content and download financial documents containing personal, banking, tax, or supplier data. In an AP/finance context, this omission can lead users to grant broad mailbox access without understanding privacy, retention, or least-privilege implications.
The setup section explicitly asks users to provide sensitive email and API credentials, including app passwords, authorization codes, OAuth client secrets, tenant IDs, and API keys, but does not include any warning about secure handling or the risks of granting third-party access. This is dangerous because finance users may paste long-lived secrets into insecure places or overprovision access to production mailboxes, enabling mailbox compromise, document exfiltration, or abuse of connected enterprise services if credentials leak.
The README advertises one-click export of extracted invoice data to Excel or business systems but does not clearly warn that structured outputs may contain sensitive financial, vendor, and possibly personal information that will be copied into external destinations. Without a prominent disclosure, users may unintentionally exfiltrate regulated or confidential data into less controlled files, shared drives, or downstream systems.
The README promotes automatic mailbox connection and attachment retrieval for invoices, which inherently involves access to privacy-sensitive and potentially confidential financial communications. While it mentions IMAP/OAuth security mechanisms, it does not clearly warn users about the scope of mailbox access, the sensitivity of fetched attachments, or the need to limit access to specific folders/accounts, which can lead to overbroad data exposure or accidental processing of unrelated emails.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Supports user uploading a single file or specifying a local folder
- Supported formats: .jpeg, .jpg, .png, .bmp, .tiff, .pdf, .doc, .docx, .xls, .xlsx
- Supported size: 50 MB (if file > 20 MB, the ADP async interface is recommended)
- Folder mode automatically performs recursive scanning, filtering by file extension
- Batch processing supports concurrency, with a default concurrency of 2 (ADP free users will automatically be limited to 1 concurrent process)
**Branch B -- Email Attachments:**
The documentation recommends npx skills add laiye-ai/adp-cli -y -g without pinning a specific version or integrity reference. That exposes users to supply-chain risk because a newer or compromised package version could be fetched and executed at install time, which is especially sensitive in a skill that also handles email access and document processing.
The command guidance presents remote script execution as a normal setup step without a strong warning or explicit consent checkpoint. In practice this normalizes unsafe installation behavior and increases the chance that users execute attacker-controlled code if the remote source is compromised or spoofed.
Section 4.3 says ADP credentials are managed via CLI, implying the skill relies on the CLI's configuration mechanism. But these earlier lines explicitly instruct saving the API key as an environment variable, which is a separate credential-storage behavior and contradicts the narrower 'managed via CLI' documentation.
The documentation states that the base URL can be auto-populated based on the user's region, distinguishing 'domestic' and 'overseas' users, but it does not indicate that the user can choose or override this locale/region handling. This is a natural-language policy concern because locale-sensitive behavior is imposed automatically rather than clearly offered as a user choice.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## 4. Configuration File Structure
All configurations are stored in the `~/.invoice_extract/` directory, with `chmod 600` permissions, and must not be committed to version control.
### 4.1 Source Configuration `source.json`
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## 4. Configuration File Structure
All configurations are stored in the `~/.invoice_extract/` directory, with `chmod 600` permissions, and must not be committed to version control.
### 4.1 Source Configuration `source.json`
Here the autonomy concern is real because the documented behavior is to automatically execute an installation script when a dependency is missing. Autonomous execution of software-install steps crosses from workflow automation into potentially dangerous system modification and code execution.
|---|---|
| Email connection failure | Terminate immediately, prompt to check connection parameters |
| Single file download/read failure | Skip, log to `failed.log`, continue processing the next file |
| ADP CLI not installed | Automatically execute the installation script |
| ADP credentials not configured / authentication failure | Terminate immediately, guide the user to execute `adp config set --api-key <KEY>` |
| ADP extraction failure (corrupted file / blank page, etc.) | Do not retry, log to `failed.log` |
| ADP async task timeout | Exponential backoff polling with `adp extract query <task_id>`, up to 3 retries |
The error-handling section says the skill will automatically execute the installation script if ADP CLI is not installed. That creates an implicit arbitrary-code execution path triggered by runtime state, without prior user approval, which is highly risky on endpoints processing finance data and email attachments.
The privacy note emphasizes local-only storage for email passwords/authorization codes, which suggests a limited local credential footprint. However, the documented configuration also stores app secrets, bearer tokens, and other cloud/API credentials in local config files, so the documentation understates what sensitive data is actually retained locally.
A file that presents all user-facing instructions in a single language can create a locale-policy concern when no opt-in or language selection is indicated. Although this appears to be a Chinese README variant, the document itself does not explicitly state that it is a localized translation or direct users to alternative language options.
The skill fetches an external installation script from a remote URL and immediately uses it for setup. External script fetching is dangerous because trust is shifted to mutable third-party content and network integrity, enabling compromise if the source repository, maintainer, or transport path is abused.
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli
# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
# Windows (PowerShell)
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
1. Licensing
1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
1. Licensing
1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
1. Licensing
1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
1. Licensing
1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
4. Disclaimer of Warranties
THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.
5. Termination