Security audit

Frappe MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is an ERPNext automation pack, but it gives agents broad authority to create, change, submit, delete, export, and run custom methods on business records with weak scoping and confirmation controls.

Install only for a tightly controlled ERPNext account with least-privilege roles. Require human review before create, update, submit, cancel, delete, export, payment, stock, and custom-method operations, and avoid enabling the generic_task or bulk_operation workflows unless the runtime enforces DocType allowlists, field/method allowlists, non-empty filters, dry runs, audit logs, and confirmation gates.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: definitions/generic_task.json:55
Finding: Unrestricted Generic ERP Operations and Arbitrary Document Method Invocation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: definitions/bulk_operation.json:82
Finding: Unsafe Bulk Deletion and Unrestricted Record Export
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: definitions/process_payment.json:43
Finding: Insufficient Validation of Payment Amounts, Parties, and References
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises an end-to-end sales workflow that culminates in invoice creation and payment recording, but it provides no user-facing warning or explicit consent checkpoint for these irreversible or sensitive financial operations. In context, this makes the skill more dangerous because it combines broad activation with actions that can affect accounting records, receivables, and customer balances.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes extremely generic phrases such as "do something," "handle this," "process," "execute," and "anything else," which can cause the skill to activate for unrelated user requests. Because this skill can perform powerful actions including create, update, delete, submit, cancel, and custom method execution, accidental invocation materially increases the risk of unintended data access or state-changing operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The sales workflow skills include creating sales orders, invoices, and a full quotation-to-payment workflow, all of which can affect transactional business records. The README presents these actions as routine examples but does not warn users that execution may create real ERP documents or trigger downstream financial process changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The process_payment skill records payment entries, which is a safety-critical financial action with potential accounting consequences. The markdown does not disclose this risk or advise users to verify amounts, counterparties, and environment before running the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown advertises a bulk_operation skill for Bulk create/update/delete, which includes potentially destructive changes to business data. The document does not provide any warning about data modification risk, confirmation requirements, reversibility, or the need for careful review before use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list is broad and generic for high-risk capabilities such as bulk create, update, delete, import, and export. This increases the chance of unintended or ambiguous invocation, which is especially dangerous because the workflow can perform destructive actions or mass data exfiltration across arbitrary DocTypes if the agent routes a loosely matching user request to this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad, generic, and map to a high-impact workflow that creates quotations, orders, invoices, and payments. This increases the chance of accidental activation from ordinary user language, which is especially dangerous because the workflow performs financially consequential actions rather than a read-only task.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow uses ${total} and ${invoice_name} in the payment step without any documented prior step that reliably derives or binds those values. In an automation that records payments, unresolved or incorrectly resolved placeholders can lead to wrong payment amounts, misapplied payments, or failures that still create partial business records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This manifest defines generic triggers such as "create customer", "add customer", and especially "new customer" without any narrowing context or exclusion conditions. In a manifest file, such broad activation phrases can cause unintended invocation when users discuss customer onboarding generally rather than explicitly invoking this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "bill customer" is broad and can match common conversational business requests that may not specifically mean creating a Sales Invoice in this system. In an automation context tied to document creation, ambiguous triggering can cause unintended invocation of an action-capable skill and lead to accidental invoice generation or billing workflows being started without sufficient user intent clarity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are generic action terms like 'create item', 'add item', and 'new product', which can cause the skill to activate from ordinary inventory-related conversation without strong contextual confirmation. Because the workflow performs a state-changing operation that creates a new Item record, unintended invocation could lead to unauthorized or accidental data creation in the inventory system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill performs a write operation that creates a persistent Item document but does not declare any user-facing warning, confirmation, or disclosure in the manifest. In an agent environment, this increases the risk that a user or upstream prompt causes silent inventory changes, especially since the skill can set pricing, warehouse, and stock-related fields with business impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description omits that the skill creates a persistent CRM record and processes personal contact information such as name, email, and phone numbers. This reduces user and operator awareness of the data-handling and write side effects, increasing the chance of accidental use and inappropriate disclosure or storage of PII.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are generic and action-oriented, so the skill may be invoked in response to common user language without enough confirmation that the user intended to create a CRM record. Because the workflow writes personal contact data directly into the CRM, unintended activation could create unauthorized or erroneous leads containing PII.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are generic enough to match common natural-language requests such as 'create project' or 'start project', which can cause this skill to activate in situations where the user did not intend to invoke it. Because the workflow directly creates a Project document with user-supplied fields and minimal guardrails, accidental invocation could lead to unwanted record creation, data clutter, or misuse of backend write capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad enough to match ordinary procurement requests and may cause this skill to activate in situations where the user did not explicitly intend to create a purchase order. Because the workflow can create a purchasing document and is wired to business tools, accidental invocation could lead to unauthorized or premature procurement actions if additional confirmation is not enforced at runtime.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON manifest applies to SQP-1, and the description 'Create a sales quotation for a customer with items' is a broad natural-language capability statement without any explicit trigger phrases, scope limits, or exclusion conditions. That ambiguity can cause unintended invocation for generic sales or customer-related requests rather than a clearly bounded action.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest declares a require_customer_credit_check guardrail, but the workflow never performs any credit-check step before calling doc.create. This creates a business-logic gap where users can generate quotations for customers without the intended validation, undermining policy enforcement and potentially enabling risky or unauthorized commercial actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger set includes generic business phrases such as "create sales order" and "process customer order," which can easily match ordinary user requests and cause the skill to activate in situations broader than intended. Because this skill creates transactional ERP records, overly broad activation increases the risk of unintended order creation, especially when combined with direct insertion of user-provided item data into the Sales Order document.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description says only 'Process payment against a sales invoice or sales order' and does not clearly disclose that the skill creates a Payment Entry that changes financial records. This can mislead users or orchestrators about the sensitivity of the action, reducing caution around a workflow that writes accounting data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are generic enough to match ordinary conversational requests about payments, increasing the chance the skill activates in situations where the user did not intend to create a financial record. In this skill, activation leads directly to creation of a Payment Entry, so accidental invocation could modify accounting data or initiate a payable/receivable workflow without sufficient user awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very generic phrases such as 'search', 'find', and 'lookup', which are likely to match many ordinary user requests unrelated to this specific skill. This can cause the skill to activate too broadly and invoke document-search capabilities in unintended contexts, increasing the chance of unnecessary data exposure or inappropriate tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger set is broad enough to activate on routine inventory-related phrases like 'stock entry' or 'stock transfer' without clearly establishing whether the user wants an action performed versus general information or review. In a skill that can create business records and potentially submit them, ambiguous activation increases the chance of unintended stock movements or draft creation from ordinary conversation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger set contains generic invoice-related phrases without explicit scoping rules, exclusions, or confirmation boundaries, which makes it unclear when this skill should activate versus when the user may be asking for advice, status, or another billing action. Because this skill can create financial records, ambiguous invocation increases the risk of unintended operational actions, especially in assistants that auto-route based on natural language triggers.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This manifest file defines activation triggers such as "add supplier" and "new vendor" without any negative examples or contextual constraints. Those phrases are relatively generic in business conversation and could cause unintended invocation when a user is discussing suppliers rather than explicitly requesting record creation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.