Security audit

FinOne Accounting (VN Merchants)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent FinOne accounting helper, but it documents sensitive financial actions through a header-less MCP service that relies on a user-supplied FinOne user ID.

Review this before installing for real merchant accounts. Use it only where the FinOne MCP server has independent authentication and server-side authorization, avoid shared-agent deployments unless memory is isolated per user, and require explicit confirmation for deletion, product/VAT changes, sync, and official e-invoice publication.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:28
Finding: Client-Controlled User ID Used as the Sole Documented Authorization Mechanism
Content: View full analysis
Profile). ``` Related instructions broaden the potential impact: ```markdown - `getUserInfo({userId})` - verify the userId resolves to a real user. Use to validate pairing before running other tools. ``` ```markdown - Never invent a `userId`. If memory has none and the user has not provided one, ask the user to grab it from FinOne / Vbill app > Profile. - If the agent is shared across multiple users (group chat, shared web widget), confirm the active `userId` at session start. Treat `finone.userId` in memory as the user's last-confirmed binding, not a fixed identity for the agent. ``` ### Technical Analysis The skill explicitly states that the MCP service uses no authentication header and that every request is authorized operationally by a caller-supplied `userId`. The identifier may be accepted directly from a user or loaded from agent memory. A numeric account identifier is not an authentication credential. Unless the remote service applies an undocumented, independent authentication and authorization control, accepting `userId` from the request creates an insecure direct object reference or broken object-level authorization condition. A caller could select another merchant's account by supplying that merchant's identifier. The documented `getUserInfo` operation only verifies that an identifier resolves to an existing account. It does not establish that the current caller owns or is authorized to access that account. It may therefore also function as an account-enumeration oracle. The risk is increased in shared agents because a reme ...[truncated 2771 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill for invoices, VAT, statistics, 'or other accounting tasks for a Vietnamese shop or micro company.' That catch-all is broader than the later trigger list and does not clearly define what accounting requests should or should not invoke this skill, increasing the chance of unintended activation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file states that currency formatting is always Vietnamese-style with '.' thousand separators and explicitly rejects an alternative format. This imposes a locale-specific output policy without user opt-in, which can conflict with organizational language/locale flexibility requirements.
Content: No source excerpt is available for this finding.