E-facture rapprochement

• Outcome: Pass
• Latest audit: Jun 4, 2026, 12:33 PM
• Version:
  1.0.0

Overview

This skill coherently reconciles invoices and bank statements, but users should run it only on intended accounting folders because it handles sensitive financial records.

Install this only if you intend the agent to process invoices, receipts, and bank statements. Start with the default sandbox, use --real only after checking the output, and verify any low-confidence or high-value extractions before relying on the generated reconciliation files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger description is intentionally broad and says to activate even when the user does not explicitly ask for reconciliation. That can cause the skill to run on loosely related accounting conversations, leading to unintended ingestion of invoices/bank statements, shell execution, and file writes against sensitive financial data.

VirusTotal

64/64 vendors flagged this skill as clean.