Security audit

Invoice Generator

Security checks for vulnerabilities and agentic risk

Overview

This invoice generator does what it says, but its HTML template can embed unsafe invoice data and loads a remote font despite claiming to be self-contained.

Review before installing or using with client-supplied data. Generated invoices should escape all text fields, validate colors and numeric values, avoid raw HTML fragments for notes or line items, and remove or disclose the remote font dependency before use for confidential business invoices.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: assets/invoice-template.html:10
Finding: Unescaped Template Substitution Allows HTML and Script Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-36`; `assets/invoice-template.html:10-27, 42-88` **Vulnerability Type**: Unescaped user-controlled data inserted into HTML and CSS contexts **Risk Level**: High ### Vulnerable Code `SKILL.md:34-36`: ```markdown 2. Read the template at `assets/invoice-template.html` 3. Replace placeholders with actual data, calculate totals 4. Save as `.html` file — user can open in browser and Print → PDF ``` `assets/invoice-template.html:10-27`: ```html .header { display: flex; justify-content: space-between; align-items: flex-start; margin-bottom: 48px; padding-bottom: 24px; border-bottom: 3px solid {{PRIMARY_COLOR}}; } .brand { font-size: 1.8rem; font-weight: 800; color: {{PRIMARY_COLOR}}; } thead th { background: {{PRIMARY_COLOR}}; color: #fff; padding: 12px 16px; text-align: left; font-size: .85rem; text-transform: uppercase; letter-spacing: .5px; } .totals-row.total { border-bottom: none; border-top: 2px solid {{PRIMARY_COLOR}}; font-weight: 800; font-size: 1.2rem; color: {{PRIMARY_COLOR}}; padding-top: 12px; } ``` `assets/invoice-template.html:42-88`: ```html <div class="header"> <div> <div class="brand">{{SENDER_NAME}}</div> <div class="party-detail">{{SENDER_ADDRESS}}<br>{{SENDER_EMAIL}}<br>{{SENDER_PHONE}}</div> </div> <div class="invoice-meta"> <h2>Invoice</h2> <p><strong>#{{INVOICE_NUMBER}}</strong></p> <p>Date: {{INVOICE_DATE}}</p> <p>Due: {{DUE_DATE}}</p> </div> </div> <div class="parties"> <div> <div class="party-label">Bill To</div> <div class="party-name">{{CLIENT_NAME}}</div> <div class="party-detail">{{CLIENT_ADDRESS}}<br>{{CLIENT_EMAIL}}</div> </div> </div> <table> <thead> <tr> <th>Description</th> <th>Qty</th> <th>Unit Price</th> <th>Amount</th> </tr> </thead> <tbody> {{LINE_ITEMS}} </tbody> </table> <div class="totals"> <div class="totals-table"> <div class="totals-row"><span>Subtotal< ...[truncated 2972 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Apply context-sensitive HTML escaping to every text value, including sender details, client details, invoice identifiers, dates, payment terms, notes, and line-item descriptions. At minimum, encode `&`, `<`, `>`, `"`, and `'`. 2. Do not accept preformatted `LINE_ITEMS` or `NOTES_SECTION` HTML from user input. Represent these values as structured data and generate the necessary elements through a trusted renderer. 3. Validate `PRIMARY_COLOR` against a strict allowlist, such as: - Six-digit hexadecimal colors matching `^#[0-9A-Fa-f]{6}$`. - A small predefined set of approved color names. 4. Parse quantities, prices, tax rates, and totals as bounded numeric values. Format them only after performing calculations with an appropriate decimal currency type. 5. Validate dates and invoice numbers against documented schemas and length limits. 6. Add a restrictive Content Security Policy, preferably through a `<meta http-equiv="Content-Security-Policy">` element for the standalone file. Disallow scripts and external resources unless explicitly required. 7. Add security tests containing payloads such as closing tags, event-handler attributes, `</style>` sequences, SVG markup, and malformed line-item data. Verify that they are displayed as inert text. 8. Update `SKILL.md` to explicitly require escaping, structured rendering, and validation rather than generic placeholder replacement. ]]>

other

Note

Location: assets/invoice-template.html:38
Finding: Remote Google Fonts Request Violates the Self-Contained Output Claim and Exposes Viewer Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17`; `assets/invoice-template.html:38` **Vulnerability Type**: Undisclosed external resource and privacy exposure **Risk Level**: Low ### Vulnerable Code `SKILL.md:17`: ```markdown OUTPUTS: Single self-contained .html file, print-ready. User opens in browser → Print → Save as PDF. Clean, professional layout. ``` `assets/invoice-template.html:38`: ```html <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700;800&display=swap" rel="stylesheet"> ``` ### Technical Analysis The template loads a stylesheet from `fonts.googleapis.com`. That stylesheet can cause subsequent font-file requests to Google-hosted domains. Consequently, the generated invoice is not self-contained despite the explicit documentation claim. Opening the invoice can disclose network metadata to an external provider, including the viewer's source IP address, user agent, approximate access time, and potentially referrer information according to browser policy. Rendering also depends on network access and the continued availability and behavior of an external service. This is not confirmed remote code execution: the reviewed URL is a stylesheet resource, and no external script or executable payload was found. The issue is instead an avoidable privacy leak, an external dependency, and a mismatch between documented and actual behavior. ### Attack Path 1. The Agent generates an invoice using the provided template. 2. A user opens the invoice while connected to the internet. 3. The browser requests the stylesheet from `fonts.googleapis.com`. 4. The returned stylesheet may direct the browser to download font files from additional Google-hosted endpoints. 5. The external provider receives request metadata associated with the invoice-viewing event. ### Impact Assessment The external provider can observe that a user opened a document using this template and collect ordinary HTTP request metadata. This may be un ...[truncated 315 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the Google Fonts `<link>` and rely on the existing system-font fallback: ```css font-family: system-ui, sans-serif; ``` 2. If the Inter font is required, package a reviewed font file locally and embed it into the generated document as a data URI so the output remains genuinely self-contained. 3. Add a Content Security Policy that blocks network requests, such as `default-src 'none'`, with narrowly scoped allowances for embedded styles and data-based fonts as needed. 4. Test the generated invoice with networking disabled and verify that its appearance and print output remain correct. 5. If remote resources are intentionally retained, clearly disclose that behavior in `SKILL.md` rather than describing the output as self-contained. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The template claims to generate a single self-contained HTML file, but it fetches a stylesheet from fonts.googleapis.com at render time. This creates an external network dependency, leaks metadata such as IP address and access timing to a third party, and can break offline or restricted-environment use, which is especially relevant for invoices that may contain sensitive business context.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The HTML declares `lang="en"` and all visible user-facing strings such as "Invoice," "Bill To," and "Payment Terms" are fixed in English. For an all-file-types policy check, this is a natural-language locale constraint with no opt-in or documented justification in the file.