Security audit

FactuCat CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its stated FactuCat invoicing purpose, but it needs Review because it can perform high-impact invoice stamping and customer delivery with broad invocation, risky API-key examples, and an unpinned global CLI install.

Before installing, confirm you trust the FactuCat npm package and account, prefer an explicit reviewed CLI version, avoid pasting live API keys into shell commands, and require a deliberate human check before any unattended `stamp` or customer-send command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: references/install-and-auth.md:3
Finding: Unpinned Globally Installed Executable Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/install-and-auth.md:37
Finding: API Key Exposure Through Command-Line and Shell-History Examples
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Enabling implicit invocation without trigger constraints allows the skill to be auto-selected in broader contexts than intended, which is risky because this skill can install software, authenticate to an external invoicing service, and perform sensitive financial actions such as stamping and sending CFDI invoices. In practice, that increases the chance of unauthorized or unintended execution, potentially leading to invoice creation, transmission, or account-affecting actions without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs users to pass a live API key directly via a command-line flag, which can expose the secret through shell history, terminal logging, process inspection, or automation logs. In this skill’s context, the credential grants access to invoice creation and related account operations, so leakage could enable unauthorized use of the FactuCat account and access to sensitive billing artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Line L03 instructs the skill to use Mexican fiscal terminology for flows, prompts, and examples. This imposes a locale-specific language constraint without explicit user opt-in or a stated mechanism to accommodate other language or terminology preferences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented unattended commands include invoice stamping and optional outbound customer delivery, both of which can trigger irreversible business actions without any explicit warning, confirmation gate, or guidance on precondition checks. In an agent or script context, this increases the risk of accidental issuance, unintended customer contact, and premature fiscal document generation from malformed or unreviewed drafts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instruction If the user sees API key inválida o revocada`` hard-codes a Spanish-only message in otherwise English documentation. This can violate language/locale policy when no opt-in or locale justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file presents symptom matching entirely through Spanish error strings such as API key inválida o revocada and No hay borrador activo. Because the document does not state that the skill is intentionally Spanish-only or provide alternatives for other locales, it implies a fixed language expectation that may violate language/locale policy.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.