Security audit

Nex Einvoice

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real local invoicing tool, but it overstates security and compliance features while persisting sensitive business and payment data locally.

Review before installing. Use this only if you are comfortable with a local CLI storing invoice, customer, seller, and payment data on disk in plaintext under ~/.nex-einvoice and writing XML exports. Do not rely on the advertised encryption, live EU VIES checks, reminders, PDF export, credit-note workflow, or full compliance guarantees without independent verification; require explicit confirmation before creating invoices, saving contacts, exporting XML, or changing invoice status.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and instructs use of shell execution, local file reads/writes, and environment-dependent setup while declaring no permissions. This creates a trust and consent gap: an agent or reviewer may treat the skill as low-risk even though it can modify local data, invoke setup scripts, and access filesystem resources.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill makes strong compliance and security claims—such as EU VIES validation, encrypted local storage, overdue/reminder handling, flexible terms, and proper credit note behavior—that static analysis indicates are not actually implemented. In an invoicing and regulatory context, these misrepresentations can lead users to generate non-compliant financial documents, mishandle tax/accounting data, or rely on protections that do not exist.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill metadata promises encrypted local storage and stronger protection guarantees, but this file loads and stores seller/payment configuration as plain JSON files and does not demonstrate encryption or access controls. In an invoicing tool that handles VAT numbers, addresses, emails, IBAN/BIC, and invoice records, this can expose sensitive financial and business data to other local users, backups, or malware on the host.

Context-Inappropriate Capability

Low

Confidence: 77% confidence
Finding: The config display command prints filesystem paths and payment-related details directly to stdout. While this is a local CLI and not a remote exposure by itself, it increases the risk of accidental disclosure through terminal logs, shell history capture, screenshots, or support transcripts, especially because IBAN/BIC and storage locations are sensitive operational data.

Intent-Code Divergence

Low

Confidence: 94% confidence
Finding: The installer states there are 'zero external dependencies' but still runs 'pip install --upgrade pip', which is a network package-management action that can change the runtime environment and pull code from external sources. This is not overtly malicious, but it is a real trust-boundary issue because installation behavior is broader than advertised and can fail or be influenced by package index/network conditions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README states that invoice and customer data is stored locally, but it presents this primarily as a privacy benefit and does not clearly warn that sensitive business and personal data will be persisted on disk in a predictable location. Users may unknowingly process VAT IDs, addresses, payment details, and invoice history on shared or insufficiently secured systems, increasing confidentiality and compliance risk.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger list includes broad everyday terms like 'invoice' and 'factuur', which can cause the skill to activate on ordinary conversation rather than clear user intent. In a skill that can create records, modify invoice state, or write files, over-broad activation increases the chance of unintended actions on sensitive financial data.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documented contact deletion command is destructive and there is no clear warning, confirmation step, or recovery guidance. Because contacts are reused in invoicing workflows, accidental or induced deletion can disrupt billing operations, corrupt historical consistency, and cause loss of business-critical customer information.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Buyer contact data is automatically persisted when a VAT number is present, without an explicit prompt or opt-in. In this context, the stored information includes business identifiers and contact data, so silent retention can violate user expectations, increase privacy/compliance risk, and enlarge the local data set available if the workstation is compromised.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Seller identity and payment details are written to local files without any warning, encryption, or visible permission hardening. Because this skill handles IBAN/BIC and company identity data for invoicing, plaintext persistence creates a meaningful confidentiality risk on shared systems and may contradict the skill's own security claims.

Static analysis

No suspicious patterns detected.