Security audit

发票查验查重及台账Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill appears built for invoice verification, but it asks the agent to fetch and run unverified remote software and handle an API key through chat.

Review this skill before installing. Only proceed if you trust the publisher and download host, are comfortable running a remotely downloaded binary, and can provide the invoice API key through a secure workflow rather than pasting long-lived credentials into chat. Prefer a version that bundles or verifies binaries with signed hashes and clearly asks before modifying installed skill files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill requires the agent to fetch and trust a remote Markdown document for installation and update behavior before execution. That creates an unbounded remote-instruction channel: the behavior of the skill can change after review, enabling prompt injection, malicious workflow changes, or unsafe command guidance unrelated to the locally reviewed package.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill authorizes downloading platform-specific executables from remote sources and then executing them locally. This exceeds the narrow invoice-verification purpose described in the skill and creates a direct software supply-chain risk: a compromised remote host, swapped binary, or altered install doc could lead to arbitrary code execution on the user's machine.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The install flow explicitly requires running a downloaded PowerShell script with `-ExecutionPolicy Bypass`, which weakens a host safety control and normalizes execution of network-fetched code. For an invoice-verification skill, this is not inherently necessary and materially increases the risk of arbitrary code execution if the download source, package, or instructions are tampered with.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The document states that the ZIP omits `bin/**` and instructs the agent to download a platform-specific executable from an external URL, then execute it. That creates an undeclared remote code acquisition and execution path not reflected in the skill's user-facing description, making the skill substantially more dangerous than advertised.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The README explicitly tells users to copy their API Key and send it to the assistant, which encourages direct disclosure of a sensitive credential into a chat channel. That creates a real risk of secret leakage, misuse of the key, and loss of control over billing or access, especially because there is no warning about credential sensitivity, storage, redaction, or safer configuration methods.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: These instructions direct the agent to download resources and a binary, then perform installation steps, but they do not present a clear warning to the user that code will be fetched from the network and executed or that the local system will be modified. That omission undermines informed consent and increases the likelihood of risky actions being taken under the guise of ordinary invoice processing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The install/update flow includes uninstalling current copies, overwriting directories, and deleting backups, yet the user is not explicitly warned about destructive filesystem changes. In a skill whose stated purpose is invoice verification, these side effects are unexpected and could cause data loss or operational disruption if the skill directory selection is wrong.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The file instructs the agent to read the local `README.md` after installation and output it verbatim to the user. Because bundled content is treated as untrusted input, this creates a built-in exfiltration channel from local package contents to the user without review, filtering, or relevance checks.

Ssd 3

Medium

Confidence: 95% confidence
Finding: This repeated requirement reinforces automatic verbatim disclosure of `README.md` immediately after install/update, regardless of content. That makes it easier for a malicious or compromised package to smuggle arbitrary instructions, secrets, or misleading text through the agent to the user.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The installation workflow mandates immediate verbatim output of the installed `README.md` once verification succeeds. This is dangerous because the package content is not independently reviewed at that point, so arbitrary local text can be surfaced directly to the user as if trusted.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The update flow repeats the same verbatim `README.md` disclosure requirement after update, preserving the same unreviewed file-content leak path. In the context of an externally downloaded package and binary, this compounds risk because both the code and the text shown to the user may come from a compromised source.

Static analysis

No suspicious patterns detected.