ADP Global Invoice Extraction · Free API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward invoice-extraction API guide, but users should understand that submitted invoices are processed by Laiye cloud services.

Install only if you are comfortable sending invoices or receipts to Laiye-operated public cloud endpoints. Use documents you are authorized to upload, avoid regulated or confidential records unless your organization permits it, and review Laiye's privacy and retention terms before production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (21)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to upload invoices and receipts to Laiye's public cloud API without an explicit warning that the source documents and extracted financial fields are transmitted to a remote third-party service. Because invoices commonly contain sensitive financial, tax, supplier, and customer data, missing disclosure can cause users or downstream agent builders to send confidential data off-platform without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The curl example instructs users to submit a file URL to a remote extraction API, causing the service to fetch and process the linked document externally. In this skill's context, that means invoice/receipt data may be disclosed to a third party, and using arbitrary public URLs also increases the chance users expose documents they did not intend to share broadly.

Content

Scanner excerpt · README-CN.md (reported line 43)May include surrounding context.

方式 1：文件 URL 地址

bash

curl -X POST "https://adp-global.laiye.com/public/v1/invoice-fast/extract" \
  -H "Content-Type: application/json" \
  -d '{
    "file_url": "shturl.cc/vZd6rD9NxsmfNZPF5KjsnB78s"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This finding is the same external transmission behavior shown in the Python example: invoice content is sent over the network to Laiye's API for remote processing. Although expected for a SaaS OCR/extraction tool, it remains a real security/privacy concern because users may unknowingly transmit confidential invoice data, and the README does not pair the example with strong warnings or handling requirements.

Content

Scanner excerpt · README-CN.md (reported line 69)May include surrounding context.

md

with open("invoice.pdf", "rb") as f:
    b64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://adp-global.laiye.com/public/v1/invoice-fast/extract",
    json={"file_base64": b64},
    timeout=180,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This finding is the same external transmission behavior shown in the Python example: invoice content is sent over the network to Laiye's API for remote processing. Although expected for a SaaS OCR/extraction tool, it remains a real security/privacy concern because users may unknowingly transmit confidential invoice data, and the README does not pair the example with strong warnings or handling requirements.

Content

Scanner excerpt · README-CN.md (reported line 69)May include surrounding context.

md

with open("invoice.pdf", "rb") as f:
    b64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://adp-global.laiye.com/public/v1/invoice-fast/extract",
    json={"file_base64": b64},
    timeout=180,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs users to send invoices and receipts to a third-party remote API, including via base64 upload, but provides no privacy notice, retention policy, consent guidance, or warning that these documents may contain sensitive financial and personal data. In this skill context, that omission is security-relevant because invoices routinely include names, addresses, tax IDs, bank/payment details, and purchase history, so users may exfiltrate regulated or confidential data without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The curl example instructs users to provide a file_url that the vendor service will fetch, creating an external transmission path for document contents and metadata. This is especially sensitive because invoices and receipts may contain confidential business and personal data, and the sample uses a shortened URL, which reduces transparency and makes destination review harder for users and auditors.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

Method 1: File URL

bash

curl -X POST "https://adp-global.laiye.com/public/v1/invoice-fast/extract" \
  -H "Content-Type: application/json" \
  -d '{
    "file_url": "shturl.cc/vZd6rD9NxsmfNZPF5KjsnB78s"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This duplicate finding flags the same Python requests.post call that uploads base64-encoded invoice content to a remote API. The risk is not the use of requests itself but the unqualified transfer of potentially sensitive documents to an external service without nearby privacy and trust-boundary disclosures.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

md

with open("invoice.pdf", "rb") as f:
    b64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://adp-global.laiye.com/public/v1/invoice-fast/extract",
    json={"file_base64": b64},
    timeout=180,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This duplicate finding flags the same Python requests.post call that uploads base64-encoded invoice content to a remote API. The risk is not the use of requests itself but the unqualified transfer of potentially sensitive documents to an external service without nearby privacy and trust-boundary disclosures.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

md

with open("invoice.pdf", "rb") as f:
    b64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://adp-global.laiye.com/public/v1/invoice-fast/extract",
    json={"file_base64": b64},
    timeout=180,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to send invoices and receipts to third-party public cloud endpoints, but it does not provide an explicit privacy, retention, or sensitive-data handling warning. Because invoices commonly contain financial, tax, customer, and company-identifying information, omission of clear disclosure can cause users to unknowingly exfiltrate sensitive business data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The curl example instructs users to submit a file URL to a public extraction API, causing the remote service to fetch document content from that URL. Even though the documentation mentions blocking internal/private IPs, the workflow still results in third-party retrieval and processing of potentially sensitive documents without strong privacy disclosure, and the sample URL format is questionable, which may also encourage unsafe or invalid usage patterns.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Method 1: File URL

bash

curl -X POST "https://adp-global.laiye.com/public/v1/invoice-fast/extract" \
  -H "Content-Type: application/json" \
  -d '{
    "file_url": "shturl.cc/vZd6rD9NxsmfNZPF5KjsnB78s"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This duplicate finding points to the same code path where local invoice content is transmitted to a public internet endpoint. In the context of invoice extraction, that means sensitive enterprise documents may leave the local environment without any built-in verification of user authorization, data sensitivity, or destination trust requirements.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

with open("invoice.pdf", "rb") as f:
    b64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://adp-global.laiye.com/public/v1/invoice-fast/extract",
    json={"file_base64": b64},
    timeout=180,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This duplicate finding points to the same code path where local invoice content is transmitted to a public internet endpoint. In the context of invoice extraction, that means sensitive enterprise documents may leave the local environment without any built-in verification of user authorization, data sensitivity, or destination trust requirements.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

with open("invoice.pdf", "rb") as f:
    b64 = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://adp-global.laiye.com/public/v1/invoice-fast/extract",
    json={"file_base64": b64},
    timeout=180,

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · README.md (reported line 413)May include surrounding context.

md

**Upgrade to the full ADP account to unlock these premium capabilities:**
- Invoice file size exceeds 2MB
- Higher API call frequency & **unlimited request quotas**
- **Custom extraction fields** (add or remove fields as needed)
- Asynchronous batch processing
- Human-in-the-loop (HITL) review workflow

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

md

**Upgrade to the full ADP account to unlock these premium capabilities:**
- Invoice file size exceeds 2MB
- Higher API call frequency & **unlimited request quotas**
- **Custom extraction fields** (add or remove fields as needed)
- Asynchronous batch processing
- Human-in-the-loop (HITL) review workflow

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language instructions in this skill file are presented entirely in Chinese, which can amount to forcing a specific language without user opt-in. The file does not indicate a language selection mechanism or point readers to alternate localized documentation within the text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README is predominantly in English, but the example API response contains a Chinese-language upgrade_message with no indication that users can choose response language or that this is limited to a China-specific locale. This creates a natural-language locale policy concern because the skill appears to impose a language on users without opt-in.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

## 1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:

•   Personal learning, research, teaching, and evaluation.  
•   Technical exchanges within academic institutions or open-source communities, non-profit projects.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 16)May include surrounding context.

md

## 1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:

•   Personal learning, research, teaching, and evaluation.  
•   Technical exchanges within academic institutions or open-source communities, non-profit projects.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 25)May include surrounding context.

md

## 1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:

•   Personal learning, research, teaching, and evaluation.  
•   Technical exchanges within academic institutions or open-source communities, non-profit projects.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 38)May include surrounding context.

md

## 4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

## 5. Termination

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document states that the agreement is governed by the laws of the People's Republic of China and requires disputes to be brought in the Licensor's local court. Under the policy provided, fixed locale/jurisdiction language can be a natural-language policy issue when no user choice or opt-in is offered and no regional limitation is explained.

Content

No source excerpt is available for this finding.