Security audit

差旅费用自动报销助手

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-built for travel reimbursement, but it can read email, download invoice links, store sensitive travel data, and submit financial forms without enough explicit approval gates.

Install only if you are comfortable giving the agent access to your mailbox, invoice PDFs, travel details, and FOL reimbursement system. Before use, manually review the exact emails, links, downloaded files, amounts, and destination system, and avoid letting it open invoice links or submit forms automatically unless you trust the source and have checked the records.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill searches long-term memory for prior reimbursement data and writes new reimbursement reason and project names back into memory. Even if limited, this persists potentially sensitive employment and project metadata beyond the immediate task, which is not clearly necessary for processing the current reimbursement and expands privacy risk over time.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The documentation says browser automation is only used for the FOL reimbursement system, but later steps direct Playwright to open invoice download links from emails and click through pages. This hidden expansion of browser scope matters because email-derived links can lead to untrusted sites, increasing exposure to phishing, tracking, credential prompts, or unsafe automation against arbitrary web content.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include broad terms related to reimbursement that could match ordinary conversation, causing the skill to activate in contexts where the user did not intend mailbox access, invoice downloading, or reimbursement submission. Because this skill handles sensitive email and finance workflows, overbroad triggering materially raises the risk of unintended execution.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill proceeds to search mailbox contents and download invoice attachments or linked files, but the description does not clearly warn users that their email content will be accessed and files will be retrieved automatically. Accessing a mailbox is highly sensitive, and lack of an explicit pre-action warning undermines informed consent and increases the chance of privacy violations.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill description omits a clear warning that it will use browser automation to upload invoices and submit reimbursement forms to an external finance system. Automated uploads and submissions can have real-world financial and recordkeeping consequences, so failing to disclose them prevents meaningful user review before irreversible actions occur.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow explicitly searches a user's mailbox, downloads invoice attachments or linked PDFs, and writes reimbursement-related data to local directories, but it provides no user-facing consent, scope limitation, or privacy notice. Because email and invoice data commonly contain sensitive personal and financial information, silent collection and local persistence increase the risk of over-collection, unintended retention, and disclosure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow instructs bulk upload of all PDF invoices to the FOL financial system without an explicit confirmation or warning that sensitive financial documents will be transmitted to an external enterprise system. This creates a real risk of sending the wrong documents, transmitting more data than intended, or exposing personal financial information without informed user approval.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide instructs the skill to OCR full invoice PDFs and emit structured JSON containing sensitive personal and corporate data, including passenger names, partially masked ID numbers, company tax identifiers, invoice text, and file paths, but provides no minimization, redaction, consent, retention, or access-control guidance. In a reimbursement workflow, this increases the risk of unnecessary collection, overexposure in logs or downstream systems, and privacy/compliance violations if the extracted data is stored or shared broadly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module downloads arbitrary external URLs extracted from email content with no visible validation, trust boundary check, or user confirmation. In this skill context, email bodies are attacker-influenced input, so this can be abused for SSRF-like access, unexpected outbound requests, or retrieval of malicious content from untrusted hosts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code executes curl and later browser automation against externally supplied URLs without any explicit consent or safety gate in code. Because the skill is designed to process invoice links from emails, an attacker can embed tracking, phishing, or internal-network-targeting links that the agent will open automatically.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The guidance explicitly instructs the agent to write derived itinerary data to `output/travel-schedule.md`, and that derived data includes sensitive travel metadata such as cities, dates, lodging presence, and trip structure. In a reimbursement automation context, persisting this information to files without a minimization rule, retention limit, access control note, or user warning increases the chance of unnecessary exposure of personal or business travel details.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The instructions require generating `output/travel-detail.md` containing reimbursement-ready records with sensitive trip information including dates, origin, destination, subsidy status, and hotel usage. This creates a structured dossier of employee movement and expense attributes, which is more privacy-sensitive than raw invoices and could be misused if stored or accessed by unintended parties.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.