T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:139- Finding
Reusable SMTP Credentials Are Transmitted to a Third-Party Invoice Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Invoicy
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent invoice API, but it asks users to send invoice data and optional SMTP passwords to a third-party service without enough disclosure or handling safeguards.
Review this carefully before installing. Use it only if you are comfortable sending invoice contents, customer details, tax IDs, bank/payment fields, and possibly SMTP credentials to ToolWeb. Avoid sending reusable mailbox passwords; prefer a dedicated low-privilege sending account or app-specific credential, and rotate any SMTP password already submitted through this service.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill enables transmission of sensitive business and personal data—including customer contact details, tax IDs, bank account information, invoice contents, and SMTP credentials—to external services, but the documentation does not clearly warn users about that data flow. This can lead to unintentional disclosure of financial and authentication data to third-party infrastructure, especially when users assume the skill operates locally or only formats documents.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill references an external API endpoint, which confirms that user-supplied invoice and email-related data may leave the local environment and be processed by a third-party service. In this context, the transmitted payload can include sensitive financial records, customer PII, tax identifiers, bank details, and possibly SMTP credentials, making external transmission materially security-relevant.
- Content
md ## References - Kong Route: https://api.toolweb.in/tools/invoicy - API Docs: https://api.toolweb.in:8165/docs
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Natural-language policy checks apply to all file types, including config/spec files. Fields such as 'gstin', 'pan', 'pincode', 'ifsc_code', 'upi_id', and 'is_igst' indicate a specific regional locale, but the spec title and descriptions do not state that this is an India-specific invoice tool or provide any locale opt-in.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This file is a manifest/config type, so vague-trigger checks apply. The root path only uses a generic summary 'Root' and provides no contextual limitation or explicit invocation scope, which makes the activation surface ambiguous rather than narrowly defined.
- Content
Static analysis
No suspicious patterns detected.