Security audit
Security checks for vulnerabilities and agentic risk
This invoice skill is mostly transparent, but it repeatedly encourages automatic financial approval and payment-readiness decisions without clear human control.
Review this carefully before installing in a finance workflow. Use it only for extraction, validation, anomaly detection, and routing suggestions; do not let it approve invoices, mark items ready for payment, or bypass your organization’s human approval and segregation-of-duties controls. Redact or limit banking, tax, and vendor data unless your environment is approved for that information.
The skill description is broad enough to invite use on many kinds of financial documents and workflows without clearly constraining scope, trust boundaries, or required human review. In a finance-processing skill, ambiguous invocation increases the chance users will submit sensitive data or rely on the skill for actions beyond simple analysis, which can lead to misuse or over-trust.
This skill is designed to process invoices containing sensitive financial, vendor, banking, and payment information, but it does not warn users about handling regulated or confidential data. Without a clear warning, users may expose bank details, tax IDs, account numbers, or internal spend data inappropriately or assume the skill is approved for unrestricted processing.
Marking fields or invoices as 'auto-approved' encourages the model or operator to treat uncertain financial data as cleared without mandatory human validation. In invoice workflows, that can cause fraudulent, altered, or incorrectly extracted data to pass through reconciliation or payment steps based on model confidence rather than verified controls.
Recommendations:
---
The skill presents a concrete rule that invoices below a threshold are automatically approved, which is an autonomous financial control decision rather than mere analysis. If followed operationally, an attacker could craft fraudulent invoices under the threshold to bypass scrutiny, making the context especially dangerous because invoice payment workflows are common fraud targets.
| Price variance | ✅ Pass | Within 5% of historical |
Approval Requirements:
This explicit 'Result: Auto-approved' output normalizes letting the skill finalize approval status, which can be misinterpreted as authorization to proceed with payment. In financial operations, that increases the risk of payment fraud, duplicate payment, or approval bypass if staff rely on the model's output as a system of record.
Approval Requirements:
### Tax Validation
Routing an invoice to 'Auto-approved' within approval workflow instructions goes beyond analysis into automated business action, and it is particularly risky because the skill also handles categorization, reconciliation, and fraud checks that could create a false sense of end-to-end trust. In this context, a user may treat the generated route as an authoritative workflow decision, enabling approval bypass or improper payment processing.
Approval Routing:
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
},
"workflow": {
"approval_required": false,
"auto_approved": true,
"ready_for_payment": true
}
}