T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/invoice.py:291- Finding
Path Traversal in Invoice Payment Status Update
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Invoice Generator
Security checks for vulnerabilities and agentic risk
Overview
This invoice skill is mostly purpose-aligned, but it handles sensitive billing records with under-scoped file writes, misleading capability claims, and unsafe fallback output behavior.
Review before installing. This is not evidence of theft or a backdoor, but it deals with sensitive invoices and business details. Use it only in a controlled workspace, verify generated output format before sending invoices, avoid untrusted client/item text until HTML escaping is fixed, and do not rely on the advertised recurring or receipt features without additional implementation and approval controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/invoice.py:167- Finding
Stored HTML Injection in Fallback Invoice Generation
- Content
View full analysis
body {{ font-family: -apple-system, Arial, sans-serif; max-width: 800px; margin: 40px auto; padding: 20px; }} .header {{ border-bottom: 3px solid #2C3E50; padding-bottom: 20px; margin-bottom: 20px; }} .invoice-num {{ color: #2C3E50; font-size: 24px; }} table {{ width: 100%; border-collapse: collapse; margin: 20px 0; }} th {{ background: #2C3E50; color: white; padding: 10px; text-align: left; }} td {{ padding: 8px 10px; border-bottom: 1px solid #eee; }} .totals td {{ text-align: right; }} .total-row {{ font-weight: bold; border-top: 2px solid #333; }} .notes {{ margin-top: 30px; padding: 15px; background: #f8f9fa; border-radius: 4px; }}{invoice['business']['name']}
{invoice['business'].get('address', '')}
{invoice['business'].get('email', '')}INVOICE {invoice['number']}Date: {invoice['date']}
Due: {invoice['dueDate']}Bill To:
""" for item in invoice['items']: html += f"\n" html += f"""
{invoice['client']}
""" if invoice.get('discount', 0) > 0: html += f"\n" if invoice.get('tax', 0) > 0: html += f"Description Qty Rate Amount {item['description']} {item['quantity']} {sym}{item['rate']:.2f} {sym}{item['amount']:.2f} Subtotal: {sym}{invoice['subtotal']:.2f} Discount ({invoice['discount']}%): -{sym}{invoice['discountAmount']:.2f} Tax ({invoice['tax']}%): ...[truncated 2715 chars] - Remediation
View remediation
``` 6. Add automated tests covering script elements, event-handler attributes, remote images, closing tags, quotes, ampersands, and malformed markup in every text field. ]]>
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill advertises capabilities that exceed what the implementation reportedly provides, while omitting persistent local storage behavior. This mismatch can cause agents and users to make unsafe assumptions about natural-language handling, output type, recurring automation, and data retention, increasing the risk of unintended file writes, silent persistence of sensitive business data, and operational misuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documentation indicates file read/write behavior and persistent storage, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates a transparency and governance gap: an agent may invoke file-capable code without users or policy layers having clear, reviewable boundaries for what filesystem access is expected.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill explicitly supports tracking payments and managing invoicing, which implies session or local persistence of financial workflow state. Persistence itself is not inherently malicious, but without clear disclosure, retention limits, and access controls, stored invoice/payment state can create confidentiality and integrity risks for financial records.
- Content
md --- name: invoice-generator description: Generate professional PDF invoices from natural language or structured data. Use when the user asks to create an invoice, bill a client, generate a receipt, track payments, or manage invoicing. Supports line items, tax calculation, discounts, multiple currencies, recurring invoices, and payment tracking. Outputs clean PDF invoices ready to send. --- # Invoice Generator
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text is broad enough to match many common business requests, which can cause the skill to trigger in contexts where invoice generation or local file creation was not the user's intent. Over-broad activation increases the chance of unnecessary access to business data, unintended document generation, or accidental persistence of sensitive information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The setup section stores business identity and contact details in a local config file under the user's home directory without prominently warning about that persistence. Business metadata may be sensitive, and silent retention can violate user expectations, especially in shared systems or managed environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The output section states that invoice files are written to the user's Documents folder but does not warn about this side effect. Writing potentially sensitive invoices to a broadly accessible default location can expose client names, billing amounts, and payment terms to other local users, backups, sync services, or accidental sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill describes automatic invoice delivery and cron-based recurring generation without any safety warning or approval model. Automation involving document creation and delivery can lead to unauthorized or erroneous invoices being generated and sent at scale, especially if configuration or recipient data is wrong.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function advertises PDF generation but silently degrades to writing an HTML file when reportlab is unavailable. In an invoicing skill, this can mislead users and downstream automation into treating output as a finalized PDF invoice when it is actually editable/rendered HTML, increasing risk of accidental disclosure, tampering, or workflow failure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill metadata promises receipt generation and recurring invoices, but the code only defines CLI arguments for recurring invoices and never implements the functionality; receipt generation is also absent. In this context, capability overstatement is dangerous because users or agent workflows may rely on payment tracking or recurring billing actions that never occur, causing missed invoices, accounting errors, or false assumptions about business state.
- Content
Static analysis
No suspicious patterns detected.