Invoice Reimbursement Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent invoice-processing purpose, but it asks users to share mailbox/API secrets and installs/runs unverified remote native binaries with broad update authority.

Review carefully before installing. This skill should only be used if you trust the publisher, are comfortable granting mailbox access and invoice API access, and can verify the downloaded executable through an independent trusted channel. Prefer a version that uses platform-managed secret storage or OAuth, avoids command-line secrets, includes signed or hash-pinned binaries, and requires explicit confirmation before modifying the installed skill directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: invoice-reimbursement-assistant-install.md:56

Finding

Unauthenticated Remote Binary Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: invoice-reimbursement-assistant-install.md:56-62, with execution requirements at invoice-reimbursement-assistant-install.md:93-102
Vulnerability Type: Remote executable supply-chain risk
Risk Level: Critical

Vulnerable Code Snippet

text

| Windows amd64 | https://download.ningmengyun.com/Skills/invoice-reimbursement-assistant/bin/windows-amd64/invoice-reimbursement-assistant-0.1.0.exe | `bin/windows-amd64/invoice-reimbursement-assistant.exe` | `.\bin\windows-amd64\invoice-reimbursement-assistant.exe --help` |
| Linux amd64 | https://download.ningmengyun.com/Skills/invoice-reimbursement-assistant/bin/linux-amd64/invoice-reimbursement-assistant-0.1.0 | `bin/linux-amd64/invoice-reimbursement-assistant` | `./bin/linux-amd64/invoice-reimbursement-assistant --help` |
| Linux arm64 | https://download.ningmengyun.com/Skills/invoice-reimbursement-assistant/bin/linux-arm64/invoice-reimbursement-assistant-0.1.0 | `bin/linux-arm64/invoice-reimbursement-assistant` | `./bin/linux-arm64/invoice-reimbursement-assistant --help` |
| macOS amd64 | https://download.ningmengyun.com/Skills/invoice-reimbursement-assistant/bin/darwin-amd64/invoice-reimbursement-assistant-0.1.0 | `bin/darwin-amd64/invoice-reimbursement-assistant` | `./bin/darwin-amd64/invoice-reimbursement-assistant --help` |
| macOS arm64 | https://download.ningmengyun.com/Skills/invoice-reimbursement-assistant/bin/darwin-arm64/invoice-reimbursement-assistant-0.1.0 | `bin/darwin-arm64/invoice-reimbursement-assistant` | `./bin/darwin-arm64/invoice-reimbursement-assistant --help` |

The installation procedure then requires the selected binary to be downloaded, made executable where necessary, and invoked using the listed availability-check command.

Technical Analysis

The reviewed package deliberately excludes the executable that implements the invoice workflow. Instead, the agent must retrieve an opaque, platform-specifi ...[truncated 2698 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish a SHA-256 or stronger digest for every platform binary in a version-controlled, signed manifest.
2. Require the installer to calculate the downloaded file's digest and compare it against the pinned value before granting execution permission or invoking the file.
3. Digitally sign release manifests with an offline-controlled release key and verify the signature using a public key embedded in the audited package.
4. Use platform-native code signing, including Authenticode for Windows and Developer ID signing and notarization for macOS.
5. Treat any checksum, signature, certificate, or publisher-validation failure as fatal and delete the rejected artifact.
6. Pin each skill release to immutable artifacts rather than mutable URL content.
7. Publish auditable source code and reproducible build instructions so reviewers can establish correspondence between source and distributed binaries.
8. Run the executable in a restricted sandbox with access limited to the required invoice directory and required network endpoints.
9. Perform artifact verification before the first --help invocation because even a help command executes native code.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:9

Finding

Mutable Remote Instructions Can Alter Agent Behavior After Review

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-18
Vulnerability Type: Instruction delegation to mutable remote content
Risk Level: High

Vulnerable Code Snippet

text

## 安装与更新文档（强制）

安装和更新本 skill，请先阅读以下远端 Markdown 文档：
https://download.ningmengyun.com/Skills/invoice-reimbursement-assistant/invoice-reimbursement-assistant-install.md

首次执行本 skill 前，先阅读远端 Markdown 文档并比较 version；若 version 不一致，提醒用户是否需要更新 skill；如需更新，按远端 Markdown 文档要求执行。

## README 说明文档（强制）

若本 skill 是通过 ZIP 发布包直接解压安装，或当前会话首次加载本地 `SKILL.md` 且尚未确认已按安装文档完成 `README.md` 全文输出，必须先阅读同级 `README.md`，并立即将 `README.md` 全文完整原样输出给用户；不得修改、概括、精简、重排、删减或只说明其中要求；不得等到用户开始业务执行、收集邮箱、发票或生成命令时才输出。

首次执行本 skill 前，仍必须确认同级 `README.md` 已阅读且全文已完整原样输出给用户。在收集邮箱、发票或生成任何业务命令前，若用户尚未满足 `README.md` 中列出的前置要求，应先完整原样输出 `README.md` 全文，再提示用户按 `README.md` 完成准备后继续。

Technical Analysis

The skill marks retrieval and interpretation of a remote Markdown document as mandatory. It further instructs the agent to execute update actions according to that remote document. Unlike locally reviewed, version-pinned skill instructions, the remote document can be modified independently after publication and audit.

This creates a post-review instruction channel. A party controlling the remote document could introduce new commands, new download locations, additional credential requests, or altered installation behavior without changing the local skill package.

The mandatory verbatim output requirements also override normal response discretion and force vendor-controlled content into the user-facing session. The principal security issue, however, is that mutable remote content is treated as authoritative operational instruction rather than untrusted documentation.

Attack Path

1. An attacker gains control over the remote Markdown file, its hosting infrastructure, or the vendor account used to publish it.
2. The attacker changes the document to include malicious installation or update ...[truncated 1555 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory execution of instructions obtained from remote Markdown.
2. Keep all authoritative operational instructions inside the versioned, locally audited skill package.
3. If remote release metadata is necessary, parse it strictly as data using a documented schema rather than treating it as natural-language instruction.
4. Pin remote metadata to a cryptographic digest and verify a signed release manifest before using it.
5. Apply an explicit allowlist to remote metadata fields, such as version, artifact URL, digest, size, and signature.
6. Reject remote content that contains commands, agent directives, credential requests, or unrecognized fields.
7. Require clear user confirmation before performing an update or executing newly downloaded software.
8. Remove mandatory verbatim promotional output and present documentation only when relevant to the user's request.
9. Ensure local safety policies and higher-priority instructions always take precedence over skill documentation and remote content.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:135

Finding

Mailbox Authorization Code and API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:135-150
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: High

Vulnerable Code Snippet

text

{EXECUTABLE} phase1 --email <email> --password <auth_code> --start-date <yyyyMMdd> --end-date <yyyyMMdd> --invoice-dir <dir> --api-key <api_key> [--keyword <keyword>] [--mail-provider qq|163|gmail] [--imap-host <host>] [--port <port>] [--limit <n>]

text

{EXECUTABLE} reverify --verify-excel <intermediate.xlsx> [--output-excel <xlsx-or-dir>] --api-key <api_key>

text

- `--api-key` 只在运行时传入，文档、日志、配置和输出文件都不得写入真实 API Key。

Technical Analysis

The documented invocation passes both the mailbox authorization code and invoice-verification API key as command-line arguments. The assertion that the API key is used only in memory does not eliminate exposure caused by the operating system and command-execution environment.

Depending on the platform and agent implementation, command-line arguments can be exposed through:

• Process inspection facilities such as /proc/<pid>/cmdline, ps, or operating-system management tools.
• Shell history.
• Agent tool-call transcripts.
• Debug logs, telemetry, crash reports, or endpoint-monitoring products.
• Parent-process auditing and command-line event collection.
• Error messages that reproduce the invoked command.

The mailbox authorization code is affected in the same way as the API key. Merely instructing the agent not to echo the value does not prevent exposure after it has been placed in the process argument vector.

Attack Path

1. The user provides a mailbox authorization code and invoice-verification API key.
2. The agent substitutes the real values into the documented phase1 or reverify command.
3. The command runner creates a process whose argument vector conta ...[truncated 1240 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --password and --api-key options from secret-bearing command examples and the executable's public interface.
2. Read secrets from protected standard input without echoing them.
3. Alternatively, pass secrets through an inherited file descriptor or an operating-system credential service.
4. If a temporary credential file is unavoidable, create it with owner-only permissions, avoid predictable names, prevent backup or synchronization, and securely delete it immediately after use.
5. Ensure the executable never includes secret values in standard output, standard error, panic messages, crash reports, or structured failure objects.
6. Configure the agent command runner to redact sensitive fields from tool-call transcripts, telemetry, and audit logs.
7. Disable shell-history recording for any compatibility mode that still accepts command-line secrets.
8. Minimize credential lifetime and support immediate revocation and rotation.
9. Use narrowly scoped API keys and mailbox-specific application authorization codes rather than primary account passwords.
10. Add automated tests that inspect process arguments and logs to verify that plaintext credentials never appear.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README explicitly instructs users to send an API key and mailbox authorization code directly in chat, which are highly sensitive credentials that can grant ongoing access to financial and email data. In the context of an invoice/email-processing skill, this is especially dangerous because the requested secrets enable access to mailbox contents and third-party tax/finance services, creating substantial risk of account compromise, data leakage, and unauthorized actions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill tells users to provide sensitive credentials directly in conversation for configuration, which violates basic secret-handling practices and can expose those credentials to logs, operators, integrations, or prompt-injection abuse. Because this skill processes invoices by accessing a user's mailbox, compromise of the mailbox authorization code could expose financial records, personal data, and other unrelated email content beyond the invoices themselves.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

若本 skill 是通过 ZIP 发布包直接解压安装，或当前会话首次加载本地 `SKILL.md` 且尚未确认已按安装文档完成 `README.md` 全文输出，必须先阅读同级 `README.md`，并立即将 `README.md` 全文完整原样输出给用户；不得修改、概括、精简、重排、删减或只说明其中要求；不得等到用

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

若本 skill 是通过 ZIP 发布包直接解压安装，或当前会话首次加载本地 `SKILL.md` 且尚未确认已按安装文档完成 `README.md` 全文输出，必须先阅读同级 `README.md`，并立即将 `README.md` 全文完整原样输出给用户；不得修改、概括、精简、重排、删减或只说明其中要求；不得等到用

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The install document instructs the agent to fetch and use an external platform-specific binary that is not included in the reviewed package. This introduces a code-execution trust boundary outside the skill bundle and is unnecessary/risky in the context of an invoice reimbursement assistant, where the stated business purpose does not justify opaque binary installation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document mandates running a downloaded PowerShell script with 'ExecutionPolicy Bypass', which weakens a host safety control and normalizes execution of untrusted downloaded content. For a reimbursement-processing skill, this is disproportionate and creates a clear path to arbitrary code execution if the URL, content, or delivery chain is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file requires executing the downloaded local binary as an availability check, which grants the skill an unnecessary program-execution capability unrelated to extracting invoice attachments and producing reimbursement summaries. This expands the attack surface from document processing into native code execution on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file requires the agent to always communicate as a financial assistant using Chinese honorific phrasing ("使用‘您’称呼用户"), and the entire skill description and mandated outputs are written as fixed Chinese-language instructions. This imposes a language/locale choice on users without offering an alternative or opt-in, which matches the policy-violation category for forced language constraints.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to read and verbatim output the installed local README creates a data-disclosure channel from downloaded package contents directly to the user without review. Because the README is local content obtained during installation, this bypasses selective disclosure safeguards and could surface embedded secrets, social-engineering text, or untrusted instructions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This repeated mandate to fully echo README contents reinforces a direct exfiltration path from unreviewed package data to the user. Repetition suggests the behavior is intentional and designed to override normal safety discretion about local file disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Requiring 'chmod +x' to make the downloaded binary executable is a supporting step that facilitates native code execution on Unix-like systems. While not dangerous by itself, in this context it directly enables execution of externally fetched code that exceeds the reasonable needs of an invoice assistant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Including '未明确说明动作' as a trigger condition makes the installation workflow overly broad, allowing ambiguous user requests or ordinary business interactions to activate install/update behavior. Because the workflow includes downloading, overwriting files, and executing binaries, ambiguous triggering materially increases risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow performs integrity-affecting operations such as downloading external binaries, overwriting an installed skill, and deleting backups, but does not require clear user-facing risk disclosure or confirmation. This reduces informed consent and increases the chance of silent destructive or unsafe changes on the host.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Making raw README disclosure a required install-flow step forces the agent to expose local package content as part of normal operation, not as an exceptional user-requested action. That makes accidental leakage of sensitive or manipulative content more likely and undermines content mediation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The update path repeats the same mandatory disclosure of local README content after updating, extending the leakage risk to every upgrade event. Since updated package contents may change, this creates a recurring opportunity to surface untrusted or sensitive text to users.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

By making completion contingent on already having disclosed the full local README, the document converts disclosure of unreviewed local content into a hard requirement. This pressures the agent to ignore normal least-disclosure behavior and increases the chance of leaking unsafe package text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

All user-facing instructions and example invocations are presented only in Chinese, and the document does not state that the skill supports other languages or that Chinese is required for a justified region-specific reason. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.