Security audit

FGO Invoicing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate FGO invoicing helper, but it gives an agent high-impact accounting powers with weak safeguards around API destination, destructive invoice actions, and sensitive debug output.

Install only if you trust the publisher and can run it in a constrained environment. Keep FGO credentials out of prompts and logs, avoid FGO_DEBUG and full payload output with real customer data, use UAT for testing, verify the API host before every real operation, and require human approval before issuing, cancelling, deleting, or reversing invoices.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fgo_cli.py:82
Finding: Configurable API Base URL Allows Sensitive Invoice Data Exfiltration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fgo_cli.py:158
Finding: Debug and Inspection Modes Disclose Authentication Hashes and Invoice PII
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fgo_cli.py:607
Finding: Destructive Invoice Operations Execute Without Explicit Confirmation Gates
Content: View full analysis
int: config = ClientConfig.from_args(args) client = FgoClient(config) cod_unic = resolve_cod_unic(args) cheie_privata = resolve_cheie_privata(args) payload = { "CodUnic": cod_unic, "Hash": _hash_invoice_op(cod_unic, cheie_privata, args.numar), "Numar": args.numar, "Serie": args.serie, "PlatformaUrl": _platform_url(), } response, _headers = client.cancel_invoice(payload) print_json({"ok": True, "response": response}) return 0 ``` ```python def run_delete_invoice(args: argparse.Namespace) -> int: config = ClientConfig.from_args(args) client = FgoClient(config) cod_unic = resolve_cod_unic(args) cheie_privata = resolve_cheie_privata(args) payload = { "CodUnic": cod_unic, "Hash": _hash_invoice_op(cod_unic, cheie_privata, args.numar), "Numar": args.numar, "Serie": args.serie, "PlatformaUrl": _platform_url(), } response, _headers = client.delete_invoice(payload) print_json({"ok": True, "response": response}) return 0 ``` ```python def run_reverse_invoice(args: argparse.Namespace) -> int: config = ClientConfig.from_args(args) client = FgoClient(config) cod_unic = resolve_cod_unic(args) cheie_privata = resolve_cheie_privata(args) payload: Dict[str, Any] = { "CodUnic": cod_unic, "Hash": _hash_invoice_op(cod_unic, cheie_privata, args.numar), "Numar": args.numar, "Serie": args.serie, "PlatformaUrl": _platform_url(), } if args.serie_storno: payload["SerieStorno"] = args.serie_storno if args.numar_storno: payload["NumarS ...[truncated 1826 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (20)

Tainted flow: 'request' from os.getenv (line 175, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The request target is derived from configurable environment/CLI input via base_url and then used directly in urlopen, so invoice payloads and authentication material can be transmitted to an arbitrary host. In this skill’s context, that is especially dangerous because the form body includes CodUnic, computed auth hashes, and full invoice/customer data, enabling exfiltration or misuse through SSRF-like redirection of trusted automation.
Content: Scanner excerpt · scripts/fgo_cli.py (reported line 177)May include surrounding context.
python
request = Request(url=url, data=payload, headers=headers, method=method) try: with urlopen(request, timeout=self.config.timeout_seconds) as response: response_body = response.read() response_headers = dict(response.headers.items())

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
The `--input` argument is validated before any file is read: 1. **Extension check** — only `.json` files are accepted. Passing `/etc/passwd`, `~/.ssh/id_rsa`, or any non-JSON path raises an error immediately. 2. **Path confinement** — the resolved path must be within the current working directory or a recognised OpenClaw media root (`/tmp/openclaw`, `~/.openclaw/workspace`, etc.). Paths that escape these roots via `../` traversal or absolute references are rejected. Always pass `--input` with a path to a file you created (e.g. a temp file written in the agent workspace). Never set `--input` to a path supplied by untrusted external content.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/fgo_cli.py (reported line 327)May include surrounding context.
python
The `--input` argument is validated before any file is read: 1. **Extension check** — only `.json` files are accepted. Passing `/etc/passwd`, `~/.ssh/id_rsa`, or any non-JSON path raises an error immediately. 2. **Path confinement** — the resolved path must be within the current working directory or a recognised OpenClaw media root (`/tmp/openclaw`, `~/.openclaw/workspace`, etc.). Paths that escape these roots via `../` traversal or absolute references are rejected. Always pass `--input` with a path to a file you created (e.g. a temp file written in the agent workspace). Never set `--input` to a path supplied by untrusted external content.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
The `--input` argument is validated before any file is read: 1. **Extension check** — only `.json` files are accepted. Passing `/etc/passwd`, `~/.ssh/id_rsa`, or any non-JSON path raises an error immediately. 2. **Path confinement** — the resolved path must be within the current working directory or a recognised OpenClaw media root (`/tmp/openclaw`, `~/.openclaw/workspace`, etc.). Paths that escape these roots via `../` traversal or absolute references are rejected. Always pass `--input` with a path to a file you created (e.g. a temp file written in the agent workspace). Never set `--input` to a path supplied by untrusted external content.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/fgo_cli.py (reported line 327)May include surrounding context.
python
The `--input` argument is validated before any file is read: 1. **Extension check** — only `.json` files are accepted. Passing `/etc/passwd`, `~/.ssh/id_rsa`, or any non-JSON path raises an error immediately. 2. **Path confinement** — the resolved path must be within the current working directory or a recognised OpenClaw media root (`/tmp/openclaw`, `~/.openclaw/workspace`, etc.). Paths that escape these roots via `../` traversal or absolute references are rejected. Always pass `--input` with a path to a file you created (e.g. a temp file written in the agent workspace). Never set `--input` to a path supplied by untrusted external content.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI accepts --base-url or FGO_API_BASE without constraining the destination, allowing an operator or compromised agent prompt to redirect authenticated invoice operations to an arbitrary server. Because this tool is specifically built to send business-sensitive invoice data externally, that configurability materially increases exfiltration risk in this skill context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares access to environment variables, local files, and networked API calls but does not define an explicit tool scope or permission boundary. In an agent setting, that increases the chance the skill is invoked with broader capabilities than necessary, enabling unintended access to secrets or filesystem content during invoicing workflows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
- `delete-invoice` - Delete an invoice via `POST /factura/stergere`. - `reverse-invoice` - Create a storno (reversal) invoice via `POST /factura/stornare`. - `get-nomenclator` - Fetch a nomenclature list (no auth required): `tara`, `judet`, `tva`, `banca`, `tipincasare`, `tipfactura`, `tipclient`, `valuta`.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The document asserts that input path validation and confinement happen before any file is read, but SKILL.md itself cannot enforce that behavior. If the underlying script does not actually implement these checks exactly as described, an agent may trust the documentation and pass attacker-controlled paths, leading to local file disclosure or processing of unintended files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document instructs users to obtain and use a private API key and suggests storing it in environment variables, but provides no guidance on secure storage, rotation, redaction, or log hygiene. In an automation/agent context, this increases the risk that credentials are exposed in prompts, traces, shell history, CI logs, or misconfigured environments, enabling unauthorized invoice operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file documents /factura/stergere and /factura/anulare, which can remove or cancel invoices, but it does not include any warning about data loss, irreversibility, or the need for operator confirmation. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
from urllib.parse import urlencode from urllib.request import Request, urlopen DEFAULT_BASE_URL = "https://api.fgo.ro/v1" DEFAULT_TIMEOUT_SECONDS = 30 DEFAULT_RETRIES = 2 RETRYABLE_STATUS_CODES = {429, 500, 502, 503, 504}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/fgo-api.md (reported line 7)May include surrounding context.
md
from urllib.parse import urlencode from urllib.request import Request, urlopen DEFAULT_BASE_URL = "https://api.fgo.ro/v1" DEFAULT_TIMEOUT_SECONDS = 30 DEFAULT_RETRIES = 2 RETRYABLE_STATUS_CODES = {429, 500, 502, 503, 504}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/fgo-api.md (reported line 10)May include surrounding context.
md
from urllib.parse import urlencode from urllib.request import Request, urlopen DEFAULT_BASE_URL = "https://api.fgo.ro/v1" DEFAULT_TIMEOUT_SECONDS = 30 DEFAULT_RETRIES = 2 RETRYABLE_STATUS_CODES = {429, 500, 502, 503, 504}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fgo_cli.py (reported line 20)May include surrounding context.
python
from urllib.parse import urlencode from urllib.request import Request, urlopen DEFAULT_BASE_URL = "https://api.fgo.ro/v1" DEFAULT_TIMEOUT_SECONDS = 30 DEFAULT_RETRIES = 2 RETRYABLE_STATUS_CODES = {429, 500, 502, 503, 504}

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Debug mode logs full request bodies and parsed responses to stderr, which can expose invoice contents, customer PII, invoice identifiers, and API-returned links or status data to logs, terminals, or higher-level agent telemetry. In an automation/agent setting, stderr is often captured centrally, so this exceeds the invoicing purpose and can create durable sensitive-data leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Cancel and delete operations execute immediately once invoked, with no confirmation gate analogous to --allow-final for invoice issuance. In an agent-driven workflow, a mistaken instruction, prompt injection, or misrouted automation step could irreversibly alter accounting records without human acknowledgement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file enables a debug mode that prints full request/response payloads to stderr, and the implementation logs form bodies and response bodies verbatim. Those payloads can include invoice/customer data and authentication-derived request content, but there is no explicit warning in the user-facing help text that debug output may expose sensitive business data in logs or terminal history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The phrase "Human-readable Romanian error message" indicates a fixed language expectation, which may conflict with language/locale policy when no user opt-in or justification is provided. SQP-3 applies to natural-language statements in any file that force a specific language without choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON example uses Romanian-specific field names and locale-bound values such as "Valuta": "RON", "Tara": "Romania", and labels like "Judet" and "Localitate". Because the file provides no accompanying indication that it is intentionally Romania-specific, it may implicitly force a locale without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.