other
- Location
SKILL.md:52- Finding
Automatic External Processing and Notification of Sensitive Financial Data Without Per-Action Consent
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:52,SKILL.md:382, andSKILL.md:637
Vulnerability Type: Automatic external transmission of sensitive financial data
Risk Level: MediumRelevant Skill Instructions
The following excerpts are faithful English translations of the relevant Skill instructions:
markdown Line 52: Optional enhancements are automatically enabled when connected, including batch OCR, online document export, meeting-calendar verification, and compliance notifications. These may connect to Tencent Docs, Tencent Cloud, Tencent Meeting, and WeCom. Line 382: When a batch OCR service such as Tencent Docs is connected, automatically enable it and invoke mcp__tencent-docs__ocr.extract for individual recognition or mcp__tencent-docs__ocr.toexcel for batch recognition. Line 637: When a severe compliance issue exists, send a WeCom notification through wecomcli-msg.Technical Analysis
The Skill handles information that may include invoice images, company names, tax identifiers, employee names, travel routes, accommodation records, vendors, transaction amounts, and internal financial policies.
The instructions state that connected external integrations are enabled automatically. In particular, invoice data may be submitted to Tencent Docs OCR without requiring explicit approval immediately before transmission. Severe compliance findings may also be sent through WeCom without an instruction to preview the message, verify its recipients, minimize its contents, or obtain per-message confirmation.
Existing authorization for an integration does not necessarily constitute informed consent to transmit every subsequently supplied invoice or compliance result. The absence of a per-action confirmation boundary increases the chance of unintended disclosure, especially where an integration is preconfigured at an organization or agent level.
The finding is limited to the documen ...[truncated 2039 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable automatic external processing by default. Use local or built-in processing unless the user explicitly selects an external provider.
- Before each external OCR operation, display:
- The service receiving the data
- The files and fields that will be transmitted
- The reason for transmission
- Whether the provider retains or logs the submitted data
- Require explicit confirmation immediately before uploading invoice content. A previously configured integration should not be treated as blanket consent.
- Apply data minimization and redaction before transmission. Remove tax identifiers, personal names, invoice numbers, and unrelated image regions unless required for the requested task.
- Require confirmation before every WeCom notification. Present a preview of the exact message and identify the destination organization, channel, group, or recipient.
- Avoid including full invoice records in notifications. Send a minimal alert and keep detailed findings in the local report.
- Validate that the user is authorized to disclose the supplied corporate and employee data to the configured external services.
- Document provider retention, deletion, encryption, region, and access-control behavior.
- Record an auditable consent event containing the selected service, approved files, approved fields, destination, and timestamp.
- Provide a persistent local-only mode that prevents all OCR uploads, document exports, calendar access, and messaging calls.