invoice-extractor-from-mail

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.0.0

Overview

The skill’s invoice automation purpose is coherent, but it needs Review because it can automatically run unverified installers while handling sensitive mailbox, invoice, and business-system credentials.

Before installing, review or replace the installer path: avoid pipe-to-shell commands, pin package versions, and require explicit approval before any dependency installation. Use a dedicated least-privilege mailbox or folder, narrow date/sender filters, confirm ADP data-processing compliance, and store mailbox, cloud, and ERP credentials in an approved secret manager rather than plaintext config where possible.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:135
• Finding: Unverified Remote Installation Scripts Are Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:127-138` and `SKILL.md:397-400` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Agent usage npx skills add laiye-ai/adp-cli -y -g # npm (recommended) npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # Linux / macOS curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Windows (PowerShell) irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex ``` The error-handling instructions also require automatic installation: ```text | ADP CLI not installed | Automatically execute the installation script | ``` ### Technical Analysis The Linux/macOS command pipes remotely retrieved content directly into `bash`. The Windows command has equivalent behavior by piping the result of `Invoke-RestMethod` into `Invoke-Expression`. Both URLs reference the mutable `main` branch rather than an immutable commit or signed release. The instructions provide no checksum, cryptographic signature, source review, or separate download-and-confirmation step. Consequently, the effective code executed by the Skill can change after the Skill package has been audited. The risk is amplified by the instruction to execute the installation script automatically when the ADP CLI is missing. This may eliminate an explicit user approval boundary and cause an Agent to execute newly retrieved code based only on the local absence of a command. Although the URL belongs to a repository associated with the declared vendor, repository ownership alone does not establish the integrity of every future response from a mutable branch. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, the `main` branch, or the artifact-delivery trust chain. 2. The attacker modifies `adp-init.sh` or `adp-init.ps1` to include arbitrary malicious commands. 3. A user or ...[truncated 1180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `irm | iex` installation patterns. 2. Do not automatically install software merely because the CLI is absent. Stop and request explicit user approval. 3. Distribute the installer as a versioned release artifact rather than retrieving it from a mutable branch. 4. Pin the artifact to an immutable version or commit. 5. Download the artifact to a local file before execution. 6. Publish and verify a cryptographic checksum or signature using a trusted verification key. 7. Display the artifact source, version, checksum, destination, and required privileges before execution. 8. Permit users to inspect the downloaded script before running it. 9. Execute installation with ordinary user privileges and avoid `sudo` or elevated PowerShell unless strictly required and separately approved. 10. Prefer a verified package-manager installation with an exact version and integrity metadata. A safer conceptual workflow is: ```bash curl -fL -o adp-init.sh "https://trusted.example/releases/vX.Y.Z/adp-init.sh" echo "<EXPECTED_SHA256> adp-init.sh" | sha256sum --check - less adp-init.sh bash adp-init.sh ``` The expected hash must come from an authenticated, independently verifiable release channel rather than the same mutable location as the script. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:127
• Finding: Unpinned Third-Party Components Are Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:127-132` **Vulnerability Type**: Insecure dependency installation **Risk Level**: High ### Vulnerable Code ```bash # Agent usage npx skills add laiye-ai/adp-cli -y -g # npm (recommended) npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli ``` ### Technical Analysis The installation commands do not specify an exact version, lockfile, integrity hash, or other immutable package identity. They can therefore resolve to dependency content that differs from the version reviewed with this Skill. The `-g` option installs the component globally, increasing its reach beyond this project. Package installation can also execute lifecycle scripts in the invoking user's context. The `-y` option suppresses confirmation in the Agent installation path, further reducing the opportunity for review. No evidence establishes that the named packages are currently malicious. The vulnerability is the unsafe supply-chain installation model: a compromised publisher account, registry, repository, or future package release could introduce malicious code without requiring any change to this audited package. ### Attack Path 1. An attacker compromises a package publisher, upstream repository, registry account, or dependency in the installation chain. 2. A malicious release becomes the version resolved by the unpinned command. 3. A user or Agent runs one of the documented installation commands. 4. The package manager downloads the attacker-controlled release. 5. Installation or lifecycle code executes in the user's context. 6. The compromised CLI remains globally available and may subsequently process sensitive invoice files and credentials. ### Impact Assessment The malicious dependency would execute with the privileges of the installing user. Potentially exposed resources include: - Files readable by the current account. - Invoice documents submitted for extraction. - Environment variables and local ADP configu ...[truncated 411 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every package to a reviewed exact version, for example `package-name@X.Y.Z`. 2. Record and verify package integrity hashes through a lockfile or equivalent trusted manifest. 3. Prefer project-local installation over global installation. 4. Remove automatic confirmation flags such as `-y` where they bypass meaningful user review. 5. Disable lifecycle scripts during installation when they are not required, then explicitly enable only reviewed setup actions. 6. Use an organization-approved registry and package allowlist. 7. Generate and review a software bill of materials for the CLI and its transitive dependencies. 8. Enable dependency provenance or signature verification where supported. 9. Require explicit user approval before installing or updating the CLI. 10. Re-audit dependencies before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:227
• Finding: Reusable Service Credentials Are Stored in Plaintext Configuration Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:227-241` and `SKILL.md:318-350` **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code The documented mailbox configuration stores an authorization code as a JSON value: ```json { "type": "imap", "params": { "host": "imap.qq.com", "port": 993, "ssl": true, "username": "[e-mail]", "password": "your_authorization_code", "mailbox": "INBOX" } } ``` Cloud-platform secrets are likewise included in configuration: ```json { "type": "cloud", "platform": "feishu", "params": { "app_id": "cli_xxxxxxx", "app_secret": "xxxxxxxxxxxxxxxx", "folder_token": "xxxxxxxx" } } ``` Business-system bearer tokens are also stored directly: ```json { "type": "api", "params": { "endpoint": "https://erp.company.com/api/v1/invoices", "method": "POST", "auth_type": "bearer", "auth_token": "your_token_here", "headers": { "Content-Type": "application/json" } } } ``` The stated protection is: ```text All configurations are stored in the ~/.invoice_extract/ directory, with chmod 600 permissions, and must not be committed to version control. ``` ### Technical Analysis The configuration design places reusable mailbox authorization codes, application secrets, folder tokens, and business-system authentication tokens directly in plaintext JSON files. Mode `0600` is a useful baseline because it prevents access by other ordinary local users. It does not encrypt the data and does not protect it from: - Malicious code running as the same user. - Compromised Agents or globally installed tools. - Insecure backups or filesystem snapshots. - Accidental copying or archive inclusion. - Processes with elevated privileges. - Credential exposure through support bundles or diagnostics. The risk is especially relevant because the same Skill recommends executing mutable remote installers. A payload executing a ...[truncated 1369 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store secrets in an operating-system credential store, such as Keychain, Credential Manager, Secret Service, or an enterprise secret manager. 2. Keep only opaque secret references or credential identifiers in JSON configuration files. 3. Prefer OAuth authorization flows with short-lived access tokens over reusable passwords or authorization codes. 4. Request the minimum service scopes required for invoice retrieval or output. 5. Separate mailbox, cloud, and business-system credentials so compromise of one does not expose all integrations. 6. Rotate secrets regularly and immediately after suspected exposure. 7. Ensure logs, previews, errors, and commands redact secret values. 8. Exclude configuration directories from backups and support archives unless encrypted. 9. Retain `0600` permissions as defense in depth, while recognizing that permissions are not a substitute for encrypted secret storage. 10. Provide a credential deletion and revocation command for decommissioning integrations. 11. Warn users when Basic Authentication or query-string API keys are selected, and prefer authorization headers over URL parameters. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (23)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill instructs users to run remote shell and PowerShell bootstrap scripts fetched directly from GitHub, including `curl ... | bash` and `irm ... | iex`. This is dangerous because it executes unreviewed remote code immediately on the user's machine, creating a direct path to arbitrary code execution and supply-chain compromise.

Chaining Abuse

High

• Category: Tool Misuse

Content

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

  # Linux / macOS
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # Windows (PowerShell)
  irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

• Confidence: 99% confidence
• Finding: The `| bash` pattern is a classic hazardous chaining construct because it streams network content directly into a shell interpreter. In this finance/email-processing skill, that is especially dangerous: compromise of the fetched script could yield immediate arbitrary command execution on systems holding mailbox credentials, invoices, and API tokens.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README promotes automatic mailbox access and attachment retrieval without clearly warning that the skill may access large volumes of sensitive email content and download financial documents containing personal, banking, tax, or supplier data. In an AP/finance context, this omission can lead users to grant broad mailbox access without understanding privacy, retention, or least-privilege implications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup section explicitly asks users to provide sensitive email and API credentials, including app passwords, authorization codes, OAuth client secrets, tenant IDs, and API keys, but does not include any warning about secure handling or the risks of granting third-party access. This is dangerous because finance users may paste long-lived secrets into insecure places or overprovision access to production mailboxes, enabling mailbox compromise, document exfiltration, or abuse of connected enterprise services if credentials leak.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises one-click export of extracted invoice data to Excel or business systems but does not clearly warn that structured outputs may contain sensitive financial, vendor, and possibly personal information that will be copied into external destinations. Without a prominent disclosure, users may unintentionally exfiltrate regulated or confidential data into less controlled files, shared drives, or downstream systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes automatic mailbox connection and attachment retrieval for invoices, which inherently involves access to privacy-sensitive and potentially confidential financial communications. While it mentions IMAP/OAuth security mechanisms, it does not clearly warn users about the scope of mailbox access, the sensitivity of fetched attachments, or the need to limit access to specific folders/accounts, which can lead to overbroad data exposure or accidental processing of unrelated emails.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Supports user uploading a single file or specifying a local folder
- Supported formats: .jpeg, .jpg, .png, .bmp, .tiff, .pdf, .doc, .docx, .xls, .xlsx
- Supported size: 50 MB (if file > 20 MB, the ADP async interface is recommended)
- Folder mode automatically performs recursive scanning, filtering by file extension
- Batch processing supports concurrency, with a default concurrency of 2 (ADP free users will automatically be limited to 1 concurrent process)

**Branch B -- Email Attachments:**

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The documentation recommends `npx skills add laiye-ai/adp-cli -y -g` without pinning a specific version or integrity reference. That exposes users to supply-chain risk because a newer or compromised package version could be fetched and executed at install time, which is especially sensitive in a skill that also handles email access and document processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The command guidance presents remote script execution as a normal setup step without a strong warning or explicit consent checkpoint. In practice this normalizes unsafe installation behavior and increases the chance that users execute attacker-controlled code if the remote source is compromised or spoofed.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: Section 4.3 says ADP credentials are managed via CLI, implying the skill relies on the CLI's configuration mechanism. But these earlier lines explicitly instruct saving the API key as an environment variable, which is a separate credential-storage behavior and contradicts the narrower 'managed via CLI' documentation.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The documentation states that the base URL can be auto-populated based on the user's region, distinguishing 'domestic' and 'overseas' users, but it does not indicate that the user can choose or override this locale/region handling. This is a natural-language policy concern because locale-sensitive behavior is imposed automatically rather than clearly offered as a user choice.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 4. Configuration File Structure

All configurations are stored in the `~/.invoice_extract/` directory, with `chmod 600` permissions, and must not be committed to version control.

### 4.1 Source Configuration `source.json`

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 4. Configuration File Structure

All configurations are stored in the `~/.invoice_extract/` directory, with `chmod 600` permissions, and must not be committed to version control.

### 4.1 Source Configuration `source.json`

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|---|---|
| Email connection failure | Terminate immediately, prompt to check connection parameters |
| Single file download/read failure | Skip, log to `failed.log`, continue processing the next file |
| ADP CLI not installed | Automatically execute the installation script |
| ADP credentials not configured / authentication failure | Terminate immediately, guide the user to execute `adp config set --api-key <KEY>` |
| ADP extraction failure (corrupted file / blank page, etc.) | Do not retry, log to `failed.log` |
| ADP async task timeout | Exponential backoff polling with `adp extract query <task_id>`, up to 3 retries |

• Confidence: 94% confidence
• Finding: Here the autonomy concern is real because the documented behavior is to automatically execute an installation script when a dependency is missing. Autonomous execution of software-install steps crosses from workflow automation into potentially dangerous system modification and code execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The error-handling section says the skill will automatically execute the installation script if ADP CLI is not installed. That creates an implicit arbitrary-code execution path triggered by runtime state, without prior user approval, which is highly risky on endpoints processing finance data and email attachments.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The privacy note emphasizes local-only storage for email passwords/authorization codes, which suggests a limited local credential footprint. However, the documented configuration also stores app secrets, bearer tokens, and other cloud/API credentials in local config files, so the documentation understates what sensitive data is actually retained locally.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: A file that presents all user-facing instructions in a single language can create a locale-policy concern when no opt-in or language selection is indicated. Although this appears to be a Chinese README variant, the document itself does not explicitly state that it is a localized translation or direct users to alternative language options.

External Script Fetching

Low

• Category: Supply Chain

Content

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

  # Linux / macOS
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # Windows (PowerShell)
  irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

• Confidence: 98% confidence
• Finding: The skill fetches an external installation script from a remote URL and immediately uses it for setup. External script fetching is dangerous because trust is shifted to mutable third-party content and network integrity, enabling compromise if the source repository, maintainer, or transport path is abused.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.