公司报销发票邮箱管理助手

• Outcome: Review
• Latest audit: Jun 23, 2026 · 3:23 AM UTC
• Version: 1.0.1

Overview

This skill appears purpose-built for invoice email automation, but it handles mailbox credentials and financial documents with several under-scoped security controls.

Review before installing. Use only a dedicated mailbox/app password, change IMAP_REJECT_UNAUTHORIZED to true unless you have a controlled test reason, run it in a restricted local workspace, and treat scan-results/ and archive/ as sensitive financial data. Avoid running it on broad date ranges or untrusted mailboxes until link allowlisting and data-retention controls are improved.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script automatically executes `npm install exceljs` at runtime if the dependency is missing. This introduces network access and arbitrary package installation into a file whose stated purpose is only ledger generation, expanding the trust boundary and creating supply-chain and execution risk if npm configuration, registries, or package resolution are compromised. In this skill context, the danger is higher because the script may run in automation environments where users do not expect it to modify the host or fetch code from the internet.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The example configuration explicitly sets rejectUnauthorized to false, which disables TLS certificate validation for the IMAP connection. If copied into real deployments, this enables man-in-the-middle attacks against email credentials and message contents, and the lack of any warning or comment makes unsafe reuse more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes a JSON file containing email metadata and potentially sensitive body text, attachment metadata, extracted invoice details, and links to disk without any access controls, minimization, redaction, encryption, or user disclosure. In the context of an IMAP mailbox scanner processing invoice emails, this can expose personal, financial, and business data to other local users, backups, logs, or downstream tooling if the output directory is accessible.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script takes URLs and parameters derived from email content and automatically performs outbound GET/POST requests, including posting extracted invoice identifiers to a third-party service. Because email content is untrusted input, this creates an SSRF-style network pivot and privacy/data-exfiltration risk, especially if an attacker can send crafted emails that trigger requests to arbitrary hosts or external invoice endpoints.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script constructs direct mailbox URLs using environment-derived account information and then writes those links into CSV/JSON outputs for later use. Those artifacts may be shared, synced, or opened by unintended users, exposing mailbox identifiers and creating a convenient path to sensitive email content if the recipient has an active session or if the URL is otherwise usable in the environment.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The script stores full extracted PDF text verbatim in `info.fullText` and then writes it to a JSON results file. Because these PDFs include invoice, company, tax, and travel data, this creates a persistent sensitive-data repository that can expose more information than necessary if the output file is accessed, copied, logged, or retained too long.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "aigc猎手竹相左边",
  "license": "MIT",
  "dependencies": {
    "exceljs": "^4.4.0",
    "iconv-lite": "^0.6.3",
    "imap": "^0.8.19",
    "mailparser": "^3.9.9",

• Confidence: 94% confidence
• Finding: Using caret ranges allows npm to resolve newer dependency versions than the one originally tested, which can introduce vulnerable or malicious upstream code through normal installs. In a skill that processes email, downloads attachments, and parses PDFs, supply-chain drift is more dangerous because dependencies handle untrusted external content and network access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "exceljs": "^4.4.0",
    "iconv-lite": "^0.6.3",
    "imap": "^0.8.19",
    "mailparser": "^3.9.9",
    "node-fetch": "^2.7.0",

• Confidence: 94% confidence
• Finding: Using caret ranges allows npm to resolve newer dependency versions than the one originally tested, which can introduce vulnerable or malicious upstream code through normal installs. In a skill that processes email, downloads attachments, and parses PDFs, supply-chain drift is more dangerous because dependencies handle untrusted external content and network access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "exceljs": "^4.4.0",
    "iconv-lite": "^0.6.3",
    "imap": "^0.8.19",
    "mailparser": "^3.9.9",
    "node-fetch": "^2.7.0",
    "pdf-parse": "^2.4.5",

• Confidence: 95% confidence
• Finding: The imap dependency is specified with a caret range, allowing unreviewed updates to a library that will likely handle mailbox authentication and remote server interaction. Because this skill’s core function is IMAP email access, compromise or regression in this dependency could expose credentials, alter mailbox contents, or enable malicious code paths in a trusted network-facing component.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"exceljs": "^4.4.0",
    "iconv-lite": "^0.6.3",
    "imap": "^0.8.19",
    "mailparser": "^3.9.9",
    "node-fetch": "^2.7.0",
    "pdf-parse": "^2.4.5",
    "pdf2json": "^4.0.3"

• Confidence: 94% confidence
• Finding: The mailparser dependency operates on untrusted email content, and a floating version range increases exposure to newly introduced parsing bugs or supply-chain compromises. Given this skill ingests inbound invoice emails, parser changes could lead to code execution chains, attachment mishandling, or data exfiltration in a high-risk input-processing path.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"iconv-lite": "^0.6.3",
    "imap": "^0.8.19",
    "mailparser": "^3.9.9",
    "node-fetch": "^2.7.0",
    "pdf-parse": "^2.4.5",
    "pdf2json": "^4.0.3"
  }

• Confidence: 93% confidence
• Finding: The node-fetch dependency is unpinned, so installs may silently pick up newer code with security regressions or malicious changes. In a workflow that may retrieve remote content or communicate with external services, this broadens the attack surface for server-side request abuse, data leakage, or supply-chain compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"imap": "^0.8.19",
    "mailparser": "^3.9.9",
    "node-fetch": "^2.7.0",
    "pdf-parse": "^2.4.5",
    "pdf2json": "^4.0.3"
  }
}

• Confidence: 95% confidence
• Finding: The pdf-parse dependency processes attacker-controlled PDF attachments, making version drift particularly risky because parser vulnerabilities are a common exploitation vector. Allowing semver-based updates without review can introduce memory, parsing, or sandbox-escape issues into a component that directly handles untrusted files from email.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"mailparser": "^3.9.9",
    "node-fetch": "^2.7.0",
    "pdf-parse": "^2.4.5",
    "pdf2json": "^4.0.3"
  }
}

• Confidence: 95% confidence
• Finding: The pdf2json dependency is also in a high-risk parsing path for untrusted invoice attachments, and caret ranges permit unreviewed code changes at install time. If an upstream release is vulnerable or malicious, it could affect document parsing integrity, availability, or potentially execution in the context of the agent environment.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: run-all.js:17

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-syntax.js:24

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: step2-download-pdf.js:215

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: step5-generate-ledger.js:33

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: lib/env.js:46

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: config/IMAP_CREDENTIALS.example.js:10