发票归集自动台账工具

• Outcome: Review
• Latest audit: Jul 10, 2026 · 1:15 AM UTC
• Version: 2.0.1

Overview

The skill is mostly a coherent local invoice OCR tool, but it needs review because full invoice images can be sent to a configurable HTTP model endpoint without enforcing that the endpoint is local.

Install only if you will keep OLLAMA_API pointed at a trusted local Ollama service, preferably localhost, because invoice images may be sent to that endpoint for VLM fallback. Review and pin/update the Python dependencies before using this on sensitive or third-party invoices.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill metadata explicitly claims local offline processing and no external data transmission, yet the dependency list includes the `requests` HTTP client. While the presence of `requests` alone does not prove exfiltration, it creates an undeclared network capability that contradicts the stated trust boundary for sensitive financial documents. In a finance/OCR tool handling invoices, this mismatch materially increases privacy and supply-chain risk.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The code imports requests and uses a configurable HTTP endpoint for Ollama, which means network communication capability exists even in a tool marketed as local/offline. If config.OLLAMA_API is changed to a non-local address, the tool could connect to an external service, undermining privacy expectations for sensitive financial workflows and potentially enabling data exposure in adjacent code paths.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The triggers use broad everyday phrases such as '整理发票' and '票据汇总', which can cause the skill to activate in contexts where the user did not intend to launch a local file-processing workflow. Because the skill can invoke terminal commands and process sensitive financial documents, accidental activation increases the risk of unintended access attempts or confusing prompts around invoice directories.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddleocr>=2.7.0
paddlepaddle>=2.6.0
PyMuPDF>=1.23.0
opencv-python>=4.8.0

• Confidence: 82% confidence
• Finding: paddleocr>=2.7.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddleocr>=2.7.0
paddlepaddle>=2.6.0
PyMuPDF>=1.23.0
opencv-python>=4.8.0
openpyxl>=3.1.0

• Confidence: 84% confidence
• Finding: paddlepaddle>=2.6.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddleocr>=2.7.0
paddlepaddle>=2.6.0
PyMuPDF>=1.23.0
opencv-python>=4.8.0
openpyxl>=3.1.0
requests>=2.31.0

• Confidence: 78% confidence
• Finding: PyMuPDF>=1.23.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddleocr>=2.7.0
paddlepaddle>=2.6.0
PyMuPDF>=1.23.0
opencv-python>=4.8.0
openpyxl>=3.1.0
requests>=2.31.0

• Confidence: 81% confidence
• Finding: opencv-python>=4.8.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paddlepaddle>=2.6.0
PyMuPDF>=1.23.0
opencv-python>=4.8.0
openpyxl>=3.1.0
requests>=2.31.0

• Confidence: 75% confidence
• Finding: openpyxl>=3.1.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

PyMuPDF>=1.23.0
opencv-python>=4.8.0
openpyxl>=3.1.0
requests>=2.31.0

• Confidence: 80% confidence
• Finding: requests>=2.31.0

Known Vulnerable Dependency: paddlepaddle==2.6.0 — 10 advisory(ies): CVE-2024-0818 (PaddlePaddle Path Traversal vulnerability); CVE-2024-0817 (PaddlePaddle command injection vulnerability); CVE-2024-1603 (PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file) +7 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: paddlepaddle==2.6.0

Known Vulnerable Dependency: opencv-python==4.8.0 — 2 advisory(ies): GHSA-qr4w-53vh-m672 (opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023); PYSEC-2023-183 (opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that )

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: opencv-python==4.8.0

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: requests==2.31.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.