Tax Invoice Guard

• Outcome: Review
• Latest audit: May 27, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a real invoice-compliance tool, but it handles sensitive financial data and credentials with unclear external-service disclosure and consent boundaries.

Install only if you are comfortable with invoice metadata and service credentials crossing external trust boundaries. Before using it on real invoices, confirm which fields are sent to OCR, tax-authority, api.yk-global.com, and Feishu services; use a dedicated scoped API key; avoid confidential invoices unless your organization approves those processors; and treat generated reports as sensitive financial records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README makes a reassuring security claim that the skill is 'sandboxed' and isolated from external systems, but elsewhere it explicitly describes calls to external tax-authority verification services and Feishu APIs. This mismatch can mislead users and integrators about actual data flows, causing them to expose sensitive invoice and tax data under false assumptions about isolation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script sends user-supplied API keys to an external domain unrelated to the core invoice parsing flow, creating an unnecessary trust and data-exfiltration boundary. Even if intended for licensing, transmitting secrets to a third-party verifier can leak credentials, usage metadata, and enable external dependency abuse or tracking.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The report states an 'authenticity' conclusion based only on local status flags such as duplicate or suspicious, not on actual authoritative invoice verification. This can mislead users into treating an internal heuristic result as a verified authenticity determination, causing incorrect compliance decisions and potential fraud acceptance or wrongful rejection.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The duplicate-checking module sends API keys to an unrelated third-party domain for entitlement verification, which is not necessary to perform local invoice deduplication. In a financial-processing skill, this creates a data-governance and supply-chain risk: sensitive credentials are disclosed off-platform, and the core function silently depends on an external service outside the apparent invoice-processing boundary.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger words include broad finance terms such as 'invoice,' 'duplicate,' 'reimbursement,' and 'compliance,' which can cause the skill to activate during ordinary business conversations. Over-triggering is risky here because the skill handles sensitive financial documents and may steer users into uploading or processing invoice data unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow documents official verification and Feishu document/Bitable export, but it does not give a clear upfront warning that invoice contents may be sent to third-party external services. Because invoices contain sensitive business, tax, and potentially personal data, lack of disclosure undermines informed consent and increases privacy and compliance risk.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger list includes broad business terms such as invoice, duplicate, reimbursement, compliance, and verification, which increases the chance of unintended activation in unrelated conversations that still contain sensitive financial context. In this skill's context, accidental activation is more dangerous because the workflow can process confidential invoice data and potentially send it to external OCR, verification, or Feishu services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow states that invoices are processed through OCR/document parsing, tax authority verification, and Feishu report generation, but it does not present a clear user-facing warning that invoice data will be transmitted to external services. Because invoices often contain tax IDs, company names, amounts, and transaction details, this omission creates a significant privacy and compliance risk, especially in enterprise or regulated environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented flow sends invoice-derived fields to an external government verification endpoint without any explicit user notice, consent step, or data-handling warning. Invoice data can contain sensitive financial and business information, so silent transmission to a third party creates a privacy and compliance risk, especially in reimbursement or enterprise contexts.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code places the raw API key in an Authorization header and transmits it to an external service without any explicit user consent or warning at the call site. This is dangerous because API keys are secrets; sending them off-box can expose them to third-party logging, compromise of the remote service, or unexpected reuse beyond local quota checks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The generated report includes detailed invoice numbers, dates, amounts, and seller information in output by default, which can expose sensitive financial and tax data if shared, logged, or stored in less-protected systems. In this skill context, reports are explicitly prepared for document platforms like Feishu, increasing the likelihood of broad internal disclosure or accidental oversharing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code transmits bearer API keys to an external verification service without any notice or consent at the point of use. Because API keys are credentials, sending them to a third party expands the trust boundary and can enable credential harvesting, misuse, or unexpected cross-service tracking if the endpoint is compromised or not controlled by the operator.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.