Security audit

smartbill

Security checks for vulnerabilities and agentic risk

Overview

This SmartBill invoicing skill is purpose-aligned, but it needs review because it can send credentials and invoice data to an unrestricted API URL and logs sensitive billing data by default.

Review before installing. Use only the official SmartBill HTTPS endpoint, avoid setting SMARTBILL_API_BASE or --base-url unless using isolated test credentials, and assume command stderr/stdout may contain customer, invoice, and response data. Do not run final invoice creation unless you have explicitly confirmed the payload and intended SmartBill account.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/smartbill_cli.py:58
Finding: Arbitrary API Base URL Can Expose SmartBill Credentials and Invoice Data
Content: View full analysis
Tuple[Any, Dict[str, str]]: url = f"{self.config.base_url}{path}" if query: compact_query = {k: v for k, v in query.items() if v is not None} if compact_query: url = f"{url}?{urlencode(compact_query)}" payload: Optional[bytes] = None if json_body is not None: payload = json.dumps(json_body).encode("utf-8") for attempt in range(self.config.retries + 1): headers = { "Authorization": self._auth_header, "Accept": accept, } if payload is not None: headers["Content-Type"] = "application/json" request = Request(url=url, data=payload, headers=headers, method=method) try: with urlopen(request, timeout=self.config.timeout_seconds) as response: ``` ### Technical Analysis The CLI accepts the API destination from either the `--base-url` argument ...[truncated 2839 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/smartbill_cli.py:136
Finding: Unconditional Debug Logging Exposes Invoice PII and API Response Data
Content: View full analysis
" print(json.dumps({ "smartbill_response": { "status": response.status, "headers": response_headers, "body": response_body_log, } }, ensure_ascii=False), file=sys.stderr) ``` ```python # --- error response debug log --- try: error_body_log: Any = json.loads(error_body.decode("utf-8")) except Exception: error_body_log = error_body.decode("utf-8", errors="replace") print(json.dumps({ "smartbill_response": { "status": exc.code, "headers": error_headers, "body": error_body_log, } }, ensure_ascii=False), file=sys.stderr) ``` ### Technical Analysis Every network request writes structured debug data to stderr without requiring a debug option. For invoice creation, the logged request body is the complete normalized invoice payload. Typical payload fields include customer names, postal addresses, email addresses, VAT codes, purchased products, prices, and invoice dat ...[truncated 2315 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tainted flow: 'request' from os.getenv (line 152, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/smartbill_cli.py (reported line 154)May include surrounding context.
python
request = Request(url=url, data=payload, headers=headers, method=method) try: with urlopen(request, timeout=self.config.timeout_seconds) as response: response_body = response.read() response_headers = dict(response.headers.items())

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill instructs use of a local Python CLI that reads credentials from environment variables, processes local files, can write output PDFs, and performs network calls to the SmartBill API, but it declares no explicit tool scope or permissions boundary. Without a declared allowlist, an agent runtime may expose broader capabilities than intended, increasing the risk of unauthorized access to secrets, unintended file operations, or external requests if the skill is invoked or modified unsafely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guidance to log the final SmartBill response can lead to unnecessary retention of customer and invoice data, including identifiers such as invoice number, company/client details, and potentially other business-sensitive fields returned by the API. In an automation skill handling billing data, broad response logging increases exposure through log aggregation systems, support access, and long-term storage, making this a real privacy and data-minimization issue even if not directly exploitable as code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI logs full request and response bodies to stderr for every API call, including invoice payloads and SmartBill responses. These payloads can contain customer names, addresses, VAT codes, product lines, pricing, and other sensitive billing data that may be captured by terminal logs, CI systems, orchestration layers, or agent transcripts without the user's awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: On HTTP errors, the code logs the full error response body and headers to stderr before raising an exception. Error responses from billing APIs often echo submitted invoice/customer data or include account metadata, so this behavior can leak sensitive information into logs even when requests fail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This JSON example uses Romanian-specific values such as VAT codes prefixed with "RO", Romanian addresses, country, currency "RON", and localized tax naming. Because the file provides only one locale-specific format and does not document that it is a Romania-specific example, it may implicitly force a specific locale without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file uses locale-specific values such as country: "Romania", Romanian field examples, and Romanian response text like Factura a fost emisa. and Descriere eroare without indicating that the skill is region-specific or giving the user a locale choice. Under the policy rule, forcing a specific language or locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The command creates parent directories and writes the downloaded invoice PDF to the specified path, which is a file-write operation affecting local user data. Although the command accepts an output path, there is no explicit warning or disclosure in comments/help text about creating directories and writing files on disk.
Content: No source excerpt is available for this finding.