银行对账单处理和转换(Bank statement processing and conversion)

• Outcome: Review
• Latest audit: Jun 9, 2026 · 4:04 PM UTC
• Version: 1.0.1

Overview

The skill appears purpose-built for bank statement conversion, but it automatically downloads and persists spreadsheet templates from the internet before processing sensitive financial files.

Install only if you are comfortable with the skill downloading spreadsheet templates from the listed internet host. For finance or regulated use, pre-provision trusted local templates, block outbound network access during conversion, and choose explicit output paths so sensitive converted files are stored where you expect.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The extension guide explicitly supports plugging in cloud OCR providers such as Baidu, Alibaba Cloud, and Tencent Cloud, which would transmit bank statement contents to external services. Because the processed documents are highly sensitive financial records, introducing external OCR without strong disclosure, consent, and data-handling controls creates a real data exfiltration and compliance risk. The skill context makes this more dangerous, not less, because bank statements commonly contain regulated personal and financial information.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code path explicitly allows template resolution to fall back to downloading files from the internet when local templates are missing. That expands a local file-conversion skill into a network-fetching component, introducing supply-chain risk, remote content tampering, and unexpected data egress paths if the download source or transport is not strictly controlled.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Automatic internet-based template retrieval is not required for statement parsing or data mapping, so it adds non-essential attack surface to a tool that handles sensitive financial inputs. In this skill context, remote fetching is more dangerous because bank statement processing often occurs in restricted environments and downloaded templates can influence generated outputs or expose operational metadata.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that it may automatically download remote template files when local templates are missing and will write outputs into the same directory as the input by default, but these behaviors are not surfaced prominently as security-relevant actions. Automatic remote retrieval introduces supply-chain and integrity risk, while default writes into input directories can overwrite expectations about where sensitive derived files are stored. In the context of bank statements, insufficient warning materially increases the chance of unintended disclosure or unsafe deployment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The evals repeatedly instruct the skill to create output files in the current directory or the source file directory without any disclosure, confirmation, or safety constraint. In a real agent environment, implicit file writes can surprise users, overwrite nearby files, expose sensitive converted data in shared locations, or normalize unsafe write behavior across prompts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code path explicitly supports automatically downloading missing template files from the internet and persisting them locally, but this wrapper function and its surrounding contract provide no user-visible warning, consent step, or integrity guarantees. In a financial-statement conversion skill, silent network egress and local file creation increase supply-chain and privacy risk, especially if the remote source or transport is compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file-level behavior explicitly states that if the local template is missing, the mapper may automatically download an Excel template from a preconfigured Internet source and then use it for output generation. Downloading executable-ish document content or trusted import templates without an explicit user warning, integrity verification, or trust validation creates a supply-chain risk: a tampered remote template could alter formulas, embedded content, metadata, or business import structure and silently affect downstream financial workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This mapper explicitly documents and invokes a template resolution flow that can automatically download a missing .xls template from the internet and store it locally, without any integrity verification, trust prompt, or user-visible disclosure in this file. In a financial data processing skill, fetching executable-like office artifacts from remote locations creates a supply-chain risk: a compromised source or MITM could replace the template with a malicious or tampered file that is then used in downstream business workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.