Global Invoice Recognition and extraction（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:22 AM UTC
• Version: 1.0.2

Overview

The invoice extraction skill is mostly purpose-aligned, but it needs Review because it recommends unverified remote script execution and advertises broader ADP capabilities than invoice-only extraction.

Install only if you trust Laiye ADP and are comfortable sending invoice or document contents to its cloud service. Prefer npm or a pinned release artifact over the curl|bash or iex installers, verify what you install, use a least-privilege API key, and require explicit approval before batch folders, URL-list processing, or any custom-app management commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:71

Finding

Unpinned Remote Installation Scripts Are Executed Directly by a Shell

Content

View full analysis

Remediation

View remediation

adp-init.sh" | sha256sum --check ``` 5. Cryptographically sign release artifacts and document signature verification using a maintained signing key. 6. Pin all examples to an exact reviewed release version or immutable commit rather than `main`. 7. Require explicit user approval before executing any downloaded installer. AI Agents must not silently install or execute remote code. 8. Prefer a user-scoped installation over a global or administrator-level installation whenever the CLI supports it. 9. Pin the recommended npm dependency to an exact reviewed version and document package-integrity verification. 10. Clearly disclose that local invoices are submitted to an external cloud service and obtain user consent before transmitting potentially sensitive documents. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes a general-purpose ADP document-processing CLI with parsing, extraction, app management, and agent automation capabilities that substantially exceed the skill’s declared invoice-only purpose. This creates a scope mismatch that can mislead agents or users into invoking broader capabilities than expected, weakening least-privilege assumptions and increasing the chance of unintended data handling or tool abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Custom application creation, editing, and management are materially different from a zero-configuration invoice extraction skill and expand the effective control surface exposed through the skill. In an agent context, this can enable unauthorized workflow changes or prompt-driven reconfiguration beyond the user’s reasonable expectation.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using curl ... | bash and PowerShell iex creates an immediate command-execution chain from network content to the local shell, a well-known high-risk pattern. In the context of an agent skill, such instructions are especially dangerous because they normalize unsafe installation behavior and could lead to full host compromise if the fetched content is tampered with.

Content

Scanner excerpt · README-CN.md (reported line 28)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

# Windows（PowerShell）
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The use of | bash and | iex is a classic chaining-abuse pattern because it turns untrusted remote content directly into executable commands without inspection. In an AI skill context this is more dangerous because an autonomous agent may repeat such instructions automatically, converting documentation text into immediate arbitrary code execution on the machine running the skill.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to install and execute remote bootstrap scripts via shell and PowerShell, including pipe-to-shell execution. This creates a direct remote code execution path in the local environment and is not necessary to describe invoice extraction behavior safely, especially when safer installation methods or manual verification steps could be used.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of a pipeline into bash enables command chaining abuse by turning untrusted remote content directly into executable shell input. In an agent context, this is especially dangerous because the step may be interpreted as an endorsed automated action rather than a high-risk manual procedure.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is unavailable)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Task querying and app management are not justified by the manifest’s narrow invoice-field extraction promise and expand the operational capabilities available to the agent. While not inherently exploitable on their own, they enlarge the attack surface and can facilitate unintended persistence, enumeration, or workflow manipulation in agent-driven environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README documents sending local documents, base64 content, and remote URLs to the ADP cloud service but does not clearly warn users about data egress, third-party processing, or privacy implications. For invoice workflows, documents often contain financial and personal information, so the missing disclosure materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Remote URL ingestion introduces a network-fetch capability that is broader than the stated invoice extraction function and may cause the service to retrieve attacker-controlled or sensitive remote resources. In agent settings, this can be abused for unintended external access patterns, processing of untrusted content, or silent transmission of referenced documents to the vendor service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README presents this skill as a general-purpose ADP CLI with broad document parsing, autonomous agent workflows, and multi-document extraction capabilities, while the skill metadata claims an invoice-only extraction scope. This scope mismatch can cause an agent or user to invoke capabilities beyond the intended least-privilege purpose, increasing the attack surface and enabling unintended processing of arbitrary documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples encourage parsing local files and remote URLs through a public cloud API, but the README does not clearly warn that document contents and URL-referenced files are transmitted off-host to an external service. In an agent setting, this can lead to unintentional exfiltration of sensitive invoices, contracts, or internal documents because operators may assume processing is local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes custom application creation, update, deletion, and AI-generated field configuration features that are unrelated to simple invoice extraction. These management operations can modify service-side extraction behavior or destroy configurations, which is dangerous in an agent context because a document-processing skill should not also grant administrative control over apps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill tells the agent to configure an API key and send invoice files or URLs to a third-party ADP service without clearly warning that document contents and credentials leave the local environment. Invoices commonly contain financial, personal, and business-sensitive data, so omission of this disclosure can lead to unintended exfiltration of confidential information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script-based installation commands are presented as normal setup steps without warning that they fetch and execute remote code. Users or agents may run them automatically, bypassing review of the downloaded content and increasing supply-chain and compromise risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands beyond invoice extraction into broader ADP platform capabilities such as IDs, orders, generic parsing, and custom extraction. This scope creep can cause an agent to process unrelated sensitive documents or invoke more powerful workflows than the user intended, increasing data exposure and misuse risk.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The installation instructions recommend executing a remotely fetched script directly from GitHub, which bypasses normal integrity review by the user. If the upstream source, repository, or distribution path is compromised, users can execute arbitrary code on their systems during installation.

Content

Scanner excerpt · README-CN.md (reported line 28)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

# Windows（PowerShell）
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The installation instructions recommend fetching and immediately executing a remote script from the network. If the upstream repository, distribution path, or transport trust is compromised, users or agents may run attacker-controlled code during installation, leading to full command execution on the host.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Listing available apps and reading cached app inventories, along with checking remaining credits, are account/service-management features rather than capabilities needed to extract invoice data. While adjacent to the service, they are not justified by the manifest's narrow invoice-processing purpose.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The command downloads a script from GitHub and immediately executes it in the shell. If the source repository, network path, or fetched script is compromised, the host running the skill can be fully compromised.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is unavailable)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

Static analysis

No suspicious patterns detected.