Security audit

发票查验查重及台账Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill has a plausible invoice-verification purpose, but it asks users to install and run unverified external binaries and handles API keys in risky ways.

Review this skill carefully before installing. Its business purpose is understandable, but installation would run native code downloaded after review and would use your invoice documents and API key. Install only if you trust the publisher and distribution channel, can verify the binary independently, and are comfortable with the API key handling and persistent changes to the agent's skill directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:16
Finding: Mandatory Vendor-Controlled Output Hijacks Agent Responses
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: batch-invoice-verify-install.md:53
Finding: Unverified Remote Native Binaries Are Downloaded and Executed
Content: View full analysis
/
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:83
Finding: Invoice API Key Is Exposed Through Command-Line Arguments
Content: View full analysis
` 传给命令。 - API Key 仅在运行时内存中使用，不写入磁盘、配置、日志、缓存或输出文件。 ``` ```markdown 2. 生成第一阶段命令时，必须已收集发票查验 API Key，并通过 `--api-key ` 传给命令；API Key 只在运行时内存中使用，不写入磁盘、配置、日志、缓存或输出文件。 ``` ```markdown 3. **第一阶段：verify**：执行 `{EXECUTABLE} verify -i [-o ] --api-key `。 5. **可选重新查验：reverify**：当用户要求重查第一阶段查验失败或空结果时，执行 `{EXECUTABLE} reverify -i [-o ] --api-key `；省略 `-o` 时默认输出 `_verify_result_reverify_yyyyMMddHHmmss.xlsx`，显式传目录时在该目录补默认文件名，显式传 `.xlsx` 时写入该文件。 ``` ```markdown - 命令：`{EXECUTABLE} reverify -i [-o ] --api-key `。 - 公开命令模板：`batch-invoice-verify reverify -i [-o ] --api-key `。 - reverify 只重查中间表中“查验状态”为空或不等于“查验成功”的记录；已经查验成功的记录原样保留。 - reverify 使用当前第一阶段生成的中间表；命令会返回刷新后的中间表和统计信息，agent 按返回结果继续后续流程。 - reverify 成功后，将返回 JSON 中的 `intermediate_excel_path` 视为当前第一阶段输出，并继续执行 `manage`。 - `--api-key` 只在运行时传入，文档、日志、配置和输出文件都不得写入真实 API Key。 ``` ### Technical Analysis The Skill requires the API key to be inserted directly into the process command line through `--api-key`. This contradicts the claim that the secret exists only in runtime memory and is not written to logs or caches. Command-line arguments can be exposed through several channels: - Process enumeration interfaces while the process is running. - Shell command history when commands are entered through a shell. - Agent tool-call transcripts and execution telemetry. - Process-monitoring, endpoint-management, or debugging products. - Error reports that record the invoked command. - ...[truncated 1355 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
若本 skill 是通过 ZIP 发布包直接解压安装，或当前会话首次加载本地 `SKILL.md` 且尚未确认已按安装文档完成 `README.md` 全文输出，必须先阅读同级 `README.md`，并立即将 `README.md` 全文完整原样输出给用户；不得修改、概括、精简、重排、删减或只说明其中要求；不得等到用

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
若本 skill 是通过 ZIP 发布包直接解压安装，或当前会话首次加载本地 `SKILL.md` 且尚未确认已按安装文档完成 `README.md` 全文输出，必须先阅读同级 `README.md`，并立即将 `README.md` 全文完整原样输出给用户；不得修改、概括、精简、重排、删减或只说明其中要求；不得等到用

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates downloading platform-specific binaries and other resources from a remote source and then executing them locally, which is a classic remote code execution and supply-chain risk. The danger is heightened because the download source is obtained from remote documentation, the binary path is then normalized into execution flow, and no signature or checksum verification is required before execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document mandates creating and executing a PowerShell script with -ExecutionPolicy Bypass to download resources. Even if framed as an installation convenience, this bypass weakens host protections and grants the skill an unnecessary mechanism for script execution that exceeds the business purpose of invoice verification. The risk is amplified because the same document also instructs downloading external binaries, so a compromised URL or modified instruction path could lead to untrusted code delivery and execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly instructs users to send an API Key to the skill/operator ('发送给我') to complete configuration, which encourages direct sharing of a sensitive credential through the chat interface. This is dangerous because API keys can be intercepted, logged, retained in conversation history, or misused to access invoice-verification services and potentially associated billing/quota without the user's full control.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires fetching and trusting a remote installation/update Markdown before first use, which extends behavior beyond local invoice verification into dynamic remote instruction intake. This creates a supply-chain and prompt-injection risk because the remote document can change over time and influence installation, update, or execution steps without being pinned, verified, or reviewed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions require the agent to address the user as a specific persona and use Chinese honorific-style wording, with no option for the user to choose another language or locale. This is a natural-language policy concern because it imposes a language/communication style constraint universally rather than making it user-selectable or clearly region-justified.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file requires the agent to read local README.md after installation and output it in full, verbatim, to the user. Forcing unconditional disclosure of a local file is a data exposure pattern: even if the file is expected documentation, the agent is being instructed to exfiltrate local content without contextual review, opening a path for prompt-injected secrets or unintended internal content to be revealed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This repeated instruction reinforces that README.md must always be fully echoed to the user without modification. Repetition increases the likelihood that an agent will obey the exfiltration behavior even when the local file may contain sensitive operational details, malicious prompt content, or environment-specific data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installation flow directs the agent to fetch a ZIP and platform binary from external URLs, overwrite local skill files, and run an availability check on the downloaded binary. This creates a supply-chain and arbitrary code execution risk, especially because there is no embedded authenticity validation such as signatures or hashes and no strong user-facing warning before modifying the system and executing code.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Making full README disclosure a required step in the installation workflow expands exposure from optional documentation access to automatic local-content release. In skill ecosystems, local files should not be blindly treated as safe because they can include hidden instructions, secrets, or attacker-supplied text bundled in the package.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The update flow repeats the same forced verbatim disclosure requirement after overwriting local files, meaning any newly introduced README content is automatically exposed. This is particularly risky in an update path because externally fetched content may have changed and could include prompt-injection text or sensitive data introduced by a compromised package source.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The completion section makes full local README output a prerequisite for finishing the task, turning content disclosure into a hard requirement. This strengthens a data leakage channel and reduces the agent's ability to apply discretion or safety filtering when local documentation contains sensitive or adversarial content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The entire README presents the skill exclusively in Chinese and gives Chinese-only example invocation text, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.