T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:41- Finding
Mutable External Executable Is Downloaded and Installed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Invoice Collector
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it needs review because it can read and forward sensitive Gmail invoice data and uses risky install and email-rendering practices.
Install only if you are comfortable granting Gmail search/read/attachment/send access and forwarding invoice contents to configured recipients. Before use, pin and verify dependencies, run screenshot rendering in an isolated environment with remote content and JavaScript blocked, review every attachment or screenshot before sending, and avoid enabling cron until recipient and scope controls are added.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:73- Finding
Unpinned Puppeteer Installation Executes Mutable npm Supply-Chain Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/collect_invoices.sh:108- Finding
Attacker-Controlled Email HTML Is Rendered in an Unsandboxed Browser
- Content
View full analysis
{ const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbox'] }); const page = await browser.newPage(); await page.setViewport({ width: 800, height: 1200 }); const html = fs.readFileSync('$INVOICE_DIR/temp.html', 'utf-8'); await page.setContent(html, { waitUntil: 'networkidle0' }); await page.screenshot({ path: '$INVOICE_DIR/$FILENAME', fullPage: true }); await browser.close(); })(); " ``` The documented workflow similarly launches Puppeteer with: ```javascript const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox'] }); const page = await browser.newPage(); await page.setContent(fs.readFileSync('/tmp/invoices/email.html', 'utf-8'), { waitUntil: 'networkidle0' }); ``` ### Technical Analysis Email HTML is untrusted input. Merely being present in the user’s inbox does not make it trustworthy: an external attacker can send an email designed to match the configured invoice query. The script loads this HTML with JavaScript and network access enabled while disabling both Chromium sandbox mechanisms. The HTML may contain scripts, images, stylesheets, iframes, fonts, or other resources referencing attacker-controlled servers. `networkidle0` causes Puppeteer to wait for network activity and therefore facilitates remote resource loading rather than enforcing an offline rendering model. Browser JavaScript does not directly receive Node.js privileges in this code. However, remote requests can disclose execution information, and a Chromium vul ...[truncated 1337 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/collect_invoices.sh:44- Finding
Configuration Values Are Interpolated into JavaScript and Filesystem Paths
- Content
View full analysis
> "$INVOICE_DIR/attachments.txt" else # Take screenshot FILENAME="${NAME}_$(date +%Y%m).png" ``` The resulting paths are inserted directly into dynamically generated JavaScript source: ```bash echo "$EMAIL_JSON" | node -e " const fs = require('fs'); let data = ''; process.stdin.on('data', chunk => data += chunk); process.stdin.on('end', () => { const json = JSON.parse(data); const msg = json.thread.messages[0]; const parts = msg.payload.parts || []; let html = ''; const findHtml = (p) => { if (p.mimeType === 'text/html' && p.body && p.body.data) { html = Buffer.from(p.body.data, 'base64').toString('utf-8'); } if (p.parts) p.parts.forEach(findHtml); }; parts.forEach(findHtml); if (!html && msg.payload.body && msg.payload.body.data) { html = Buffer.from(msg.payload.body.data, 'base64').toString('utf-8'); } fs.writeFileSync('$INVOICE_DIR/temp.html', html || 'No content'); }); " ``` ```bash cd /tmp && node -e " const puppeteer = require('puppeteer'); const fs = require('fs'); (async () => { const browser = await puppeteer.launch({ headless: 'new', args: ['--no-sandbox', '--disable-setuid-sandbo ...[truncated 2435 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/collect_invoices.sh:36- Finding
Predictable Shared Temporary Directory Stores Sensitive Invoice Data
- Content
View full analysis
` path or monitors the shared temporary namespace. 3. The script accepts the existing directory because it uses `mkdir -p`. 4. Sensitive attachments and rendered email content are written into that path. 5. Depending on ownership, permissions, and path structure, the attacker may observe or interfere with the files. 6. Alternatively, an intermediate command fails, and the absence of an exit trap leaves sensitive files behind for later recovery. ### Impact Assessment The affected data can include invoices, receipts, sender details, billing identifiers, financial amounts, and complete email HTML. The primary scope is disclosure or manipulation by another local account with ...[truncated 98 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is explicitly designed to collect mailbox content and send attachments or screenshots to another email address, which is a direct data disclosure capability. Because invoices and receipts often contain sensitive financial and personal information, natural-language triggering without strong recipient validation or confirmation materially increases leakage risk.
- Content
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
md This skill uses `--no-sandbox` when launching Puppeteer/Chromium. This is **required** in many environments: - **WSL (Windows Subsystem for Linux)**: Chrome sandbox requires kernel features not available in WSL1/WSL2 - **Docker containers**: Unless running with `--privileged` or specific seccomp profiles - **CI/CD environments**: Most runners don't support Chrome's sandbox **Risk**: Disabling the sandbox means if a malicious HTML email were rendered, it could potentially execute code outside the browser context.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- Download JSON
bash gog auth credentials ~/path/to/client_secret.json gog auth add your@gmail.com
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash export GOG_ACCOUNT="user@gmail.com" export GOG_KEYRING_PASSWORD="your-password" # Search all invoices in date range gog gmail search '(invoice OR receipt OR 請求書 OR 領収書 OR billing OR payment) after:2026/01/01 before:2026/02/01'
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented workflow operationalizes exfiltration by instructing the user to search, download, summarize, and send collected invoice files and screenshots onward. This is especially risky because screenshots of emails without PDFs may include more sensitive content than a standalone invoice attachment, expanding the disclosure scope.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Date format**: `YYYY/MM/DD` for gog search - **PDF priority**: Always prefer PDF attachments over screenshots - **Japanese fonts**: Required for correct rendering of JP emails - **Cleanup**: `rm -rf /tmp/invoices` after sending - **Cron**: Set up monthly cron job for recurring collection
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Date format**: `YYYY/MM/DD` for gog search - **PDF priority**: Always prefer PDF attachments over screenshots - **Japanese fonts**: Required for correct rendering of JP emails - **Cleanup**: `rm -rf /tmp/invoices` after sending - **Cron**: Set up monthly cron job for recurring collection
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Date format**: `YYYY/MM/DD` for gog search - **PDF priority**: Always prefer PDF attachments over screenshots - **Japanese fonts**: Required for correct rendering of JP emails - **Cleanup**: `rm -rf /tmp/invoices` after sending - **Cron**: Set up monthly cron job for recurring collection
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The top-level description is broad enough to activate on generic requests about invoices or receipts while also enabling mailbox search, attachment download, screenshot capture, and forwarding. That combination increases the chance the skill is invoked without an explicit user confirmation about scope, recipient, date range, or sensitivity of the collected email contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description emphasizes convenience but does not clearly warn that it may forward sensitive financial emails, attachments, and screenshots to another address. Users may not understand that invoice PDFs and rendered email bodies can contain account numbers, billing details, addresses, or tax information before the skill sends them onward.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
4. Install Japanese fonts (optional, for JP emails)
bash sudo apt install fonts-noto-cjk
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example prompts normalize forwarding invoices to external or organizational addresses directly from natural language, which lowers the barrier to unreviewed disclosure of mailbox contents. Prompt examples strongly shape agent behavior, so examples that omit confirmation and scope checks increase real-world leakage risk.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Tips - **Date format**: `YYYY/MM/DD` for gog search - **PDF priority**: Always prefer PDF attachments over screenshots - **Japanese fonts**: Required for correct rendering of JP emails - **Cleanup**: `rm -rf /tmp/invoices` after sending - **Cron**: Set up monthly cron job for recurring collection
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script unconditionally removes the temporary invoice directory with
rm -rfafter processing. Although progress messages are printed for other actions, there is no user-facing disclosure in the usage/comments that downloaded invoice PDFs and screenshots will be automatically deleted at the end, which affects user data retention and can surprise operators who expect artifacts to remain available.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The sample subject, body text, and example prompts are written in Japanese, which can imply a fixed language/locale for generated content and usage patterns. Because the file does not explicitly state that the skill is Japan-specific or offer users a choice of language, this creates a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example subject is written in Japanese, and the outgoing email body later in the script is hard-coded in Japanese. This imposes a specific language/locale on recipients without any documented opt-in or configuration for alternate languages, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The message body sent to recipients is entirely hard-coded in Japanese, with no option to select another language or confirm that Japanese is appropriate. Because this file is otherwise a generic invoice-collection script, the fixed locale appears to be imposed rather than clearly scoped to a region-specific workflow.
- Content
Static analysis
No suspicious patterns detected.