T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/unzip_and_parse.py:61- Finding
Unbounded Processing of Untrusted ZIP Archives and XML Documents
- Content
View full analysis
- Remediation
View remediation
Security audit
Expense Reimbursement
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for reimbursement automation, but it handles sensitive travel and financial documents with broad recursive scanning, persistent summary storage, and unsafe ZIP extraction that users should review before installing.
Install only if you are comfortable giving the skill access to a dedicated reimbursement folder. Use a narrowly scoped directory, review files before scanning ZIPs, avoid untrusted archives, and delete or disable the ~/memory summary if it may contain sensitive employer, travel, project, or payment details.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:43- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad end-to-end reimbursement workflow tool, but the supplied code chunk only performs a narrow subset: unzip local ZIP archives and parse XML invoices into a console summary. It does not implement OCR, document classification, filing, form completion, PDF packaging, or interactive confirmation. It also appears limited to XML-based taxi invoice parsing rather than the full set of travel receipt types claimed. There is no evidence of undeclared harmful behavior; the issue is that the implementation is materially less capable and narrower in purpose than described.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill describes file-system scanning, ZIP inspection, OCR, and document generation, but it does not declare any explicit tool scope or permissions boundaries. In a skill that handles sensitive reimbursement documents, missing scope declarations increases the risk of over-broad file or environment access and makes it harder for users and the platform to enforce least privilege.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill processes highly sensitive personal and business-travel records, including receipts, itinerary data, OCR-extracted content, and reimbursement forms, but does not clearly disclose privacy risks. Without prominent notice and consent, users may expose financial, location, employer, and travel details more broadly than intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
A broad trigger like '帮我整理报销' can activate on ordinary conversational requests without establishing clear boundaries, consent, or safe preconditions. Because this skill can scan files, process sensitive receipts, and create or modify local artifacts, ambiguous activation increases the chance of unintended handling of personal or corporate financial documents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persisting a conversation summary under ~/memory creates an additional copy of sensitive reimbursement data, potentially including travel dates, destinations, amounts, and project information, without explicit user-facing warning or consent. This expands the data retention surface and increases the risk of later unauthorized access or accidental disclosure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown explicitly labels Step 7.4 as '用户回复「确认」后执行', implying a separate checkpoint before creating the scan/print folder. However, the immediately preceding Step 7.3 report says that after confirming the generated print package, the skill will create the folder next, so Step 7.4 is not actually treated as an independent confirmation gate. This contradicts the documented '每步停顿确认' requirement for 7.4.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow explicitly instructs OCR of screenshots and recursive scanning of all reimbursement files, including ZIP contents, which are likely to contain sensitive personal and financial data such as travel records, addresses, receipts, and reimbursement forms. Because the workflow does not mention consent prompts, scope limitation, data minimization, or retention/handling safeguards, it creates a real privacy and data-exposure risk if the skill processes unintended files or over-collects sensitive content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language instructions and messages that force a specific language/locale experience. Under the policy, language constraints should either be optional, user-selectable, or explicitly justified as region-specific.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The docstring says Step 8 will find the signed form and place it into '扫描打印文件/'. But the recursive glob searches the entire trip directory, including '扫描打印文件', so if the signed PDF is already there from Step 7.4, 'signed_files[0]' may resolve to the destination path itself and the copy operation no longer performs the intended archival action. The documented behavior is therefore not reliably what the code does.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes OCR, support for multiple receipt types (taxi, train, flight, hotel), trip-type judgment, auto-archiving, form filling, PDF package generation, and user confirmation checkpoints. This script's documented purpose and implemented behavior are much narrower: it only extracts ZIP files and parses XML invoice fields, mainly for Gaode taxi receipts.
- Content
Static analysis
No suspicious patterns detected.