全场景开票

• Outcome: Review
• Latest audit: Jul 24, 2026 · 9:09 AM UTC
• Version: 1.0.0

Overview

The skill’s invoicing purpose is coherent, but it asks for high-impact financial credentials and actions while also downloading and running remote binaries with weak scoping and disclosure.

Review before installing. Use only in a controlled environment, verify the downloaded binary and ZIP out of band, avoid pasting long-lived API keys into chat, use a scoped and rotatable key, confirm the service endpoint uses TLS, and understand that the skill may store invoice documents and task/config state locally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installation document expands the skill from invoice-related business logic into software deployment behavior: downloading packages, replacing local files, and executing binaries. This broadens the trust boundary significantly and creates an attack surface for supply-chain compromise, unauthorized system modification, and persistence that is not justified by the declared invoicing purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to fetch and execute an external platform-specific binary from a remote URL, which is a classic supply-chain risk. Even if the URL is legitimate today, compromise of the hosting location, DNS, TLS termination, or release process could result in arbitrary code execution on the host.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The example input and example output contradict the documented matching rules, which can cause implementers or downstream agents to apply the wrong user-facing message and terminate the wrong branch. In a security-sensitive workflow such as tax and invoicing authorization, misleading exception handling can mask real failures, confuse users, and drive incorrect operational decisions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The referenced skill introduces enterprise profiling and risk-analysis behavior that is outside the parent skill's declared invoice issuance/authorization scope. This scope expansion can cause unexpected collection and processing of business data, increasing the chance of unauthorized data use and privilege creep within the agent workflow.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill requires personalAccount and areaCode alongside a USCC to retrieve enterprise information, but the need for those identifiers is not clearly justified by the parent invoice-issue scenario. Collecting extra identifiers beyond what is necessary raises privacy and least-privilege concerns and can expose sensitive account-linked data if the workflow is misused.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The document gives conflicting instructions: one section requires outputting a standardized batch invoice JSON draft, while an earlier rule forbids exposing the full task JSON or full `check_result.invoice_payload_json` in normal conversation. In an invoicing workflow, this ambiguity can cause an agent to reveal sensitive billing data, tax IDs, account-linked information, or internal task state when resolving the conflict incorrectly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly tells users to copy an API Key and send it to the skill/operator, but provides no warning that the key is a sensitive credential or guidance to use a secure secret-handling flow. In this skill context, the API key is tied to invoice issuance permissions and specific enterprises, so disclosure could let an unauthorized party issue invoices, access billing functions, or abuse a company's tax/invoicing authority.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger language is overly broad, causing installation or update behavior to run whenever a user asks to check or prepare the skill before execution. That increases the chance that routine business requests unintentionally cause software installation steps, network access, or local system changes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document directs external binary download and replacement without presenting clear supply-chain or system-modification warnings to the user. This can lead operators to approve risky actions without understanding that untrusted code is being introduced and executed on their machine.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow includes backup/removal of existing directories and overwrite installation, but does not clearly flag these as destructive operations. This can cause unintended data loss, downtime, or replacement of a working installation with an unverified one.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases are very broad and do not clearly constrain when this exception-handling template should activate, increasing the chance it will override unrelated business logic. Because the template forces immediate termination and direct message display, accidental activation can suppress normal safeguards or produce incorrect outputs in other flows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow handles sensitive personal-account information and may fall back to public web search, but it does not define an explicit user-facing privacy disclosure or boundary on what data may be sent or inferred. This can result in users being unaware that sensitive identifiers are being processed or that external sources may be consulted during the lookup.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to run a local executable that reads and writes task JSON, creates Markdown artifacts, and may auto-create or modify workspace configuration, but it never requires explicit user consent or disclosure of these side effects. In an agent setting, hidden filesystem and process execution can expose local data, alter persistent state, or cause unintended actions beyond what the user expects from a conversational invoice-permission workflow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to download invoice originals (PDF/XML/OFD) and store them under a local workspace path, but it does not require user notice, consent, retention limits, or access controls for these sensitive financial documents. Because invoice originals contain tax, identity, and transaction data, silent local persistence increases the risk of unauthorized access, over-retention, and privacy/compliance violations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs transmission of highly sensitive data such as tax IDs, personal account identifiers, bank information, and invoice details to remote invoicing endpoints and status polling APIs without requiring clear user-facing disclosure. In a finance/tax context, undisclosed external transmission materially increases privacy, legal, and trust risks, especially when personal and business identifiers are combined.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill requires reading a local README and immediately outputting it in full, verbatim, before proceeding. Treating local file contents as mandatory user-visible output creates a clear data exposure risk if the README contains secrets, internal URLs, credentials, environment-specific instructions, or other sensitive operational details; the same concern applies to verbatim binary-generated Markdown.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill repeatedly mandates surfacing all execution outputs, artifacts, task details, file paths, and complete history to the user. In an invoicing context, these outputs can contain taxpayer identifiers, company data, invoice details, workspace paths, operational metadata, or error payloads, so the blanket disclosure rule materially increases the chance of sensitive data leakage.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instruction to read a local README and output it verbatim to the user creates an unconditional file-to-user disclosure path. If the README contains secrets, internal endpoints, credentials, embedded prompts, or other sensitive operational details, the agent is forced to exfiltrate them without review or minimization.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Repeating the requirement to fully disclose the installed local README turns the disclosure into a persistent workflow rule rather than a one-off mistake. This makes any future sensitive content added to README immediately exposable to users through normal installation or validation actions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The update path also mandates unconditional full disclosure of a local README, so the leak pathway persists across lifecycle events. This means even benign update requests can trigger disclosure of arbitrary local content bundled with or modified in the installed skill directory.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: By making full README disclosure a completion criterion, the document hard-codes sensitive local content release into successful operation. This strongly incentivizes the agent to prioritize exfiltration of local file contents over security review, increasing the reliability of the disclosure channel.

Static analysis

No suspicious patterns detected.