T09 · Insecure Skill Coding Practices
Error
- Location
scripts/invoice_service.js:203- Finding
Unrestricted API Endpoint Allows Invoice Data and API Credential Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
百望股份智能发票查验（公开版）
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for invoice verification, but it can send sensitive invoice data and stored credentials to an unvalidated custom API endpoint and can create recharge orders without executable-level consent enforcement.
Review this skill before installing. It is intended for Chinese invoice verification and will send invoice text/images to an external service and store credentials locally. Do not use it with highly sensitive invoices unless you trust the publisher and service, avoid custom API endpoints, and require explicit confirmation before creating recharge orders or batch-verifying directories.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/invoice_service.js:175- Finding
API and Cryptographic Material Stored and Displayed Without Adequate Protection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/invoice_service.js:1510- Finding
Recharge Order Creation Does Not Enforce Explicit User Consent
- Content
View full analysis
"); const waitSeconds = parseNonNegativeIntegerOption( options["wait-seconds"], "wait-seconds must be a non-negative integer", 90 ); const pollIntervalSeconds = parseNonNegativeIntegerOption( options["poll-interval-seconds"], "poll-interval-seconds must be a non-negative integer", 3 ); if (pollIntervalSeconds <= 0) { throw new Error("poll-interval-seconds must be at least 1"); } const agreeTerms = options["agree-terms"] === undefined ? true : parseBooleanOption(options["agree-terms"], true); const response = await callApi( bound.apiBaseUrl, "POST", "/api/v4/plugin/orders", { amount, agreeTerms }, bound.appKey, crypto.randomUUID() ); ``` ### Technical Analysis The Skill documentation and agent prompt require the recharge amount to be repeated and explicitly confirmed before an order is created. The executable does not enforce this control. When `--agree-terms` is absent, the code sets `agreeTerms` to `true`. A direct invocation, erroneous agent action, or integration that omits the flag therefore submits an order as though consent had been provided. Agent-level instructions are not a reliable authorization boundary. Transaction-sensitive requirements must be enforced in the executable path that performs the remote state-changing operation. ### Attack Path 1. An attacker induces the agent to invoke the order command, or an automation integration calls it without obtaining confirmation. 2. The command supplies only an amount, such as `create-order --amount 100`. 3. Because `--agree-terms` is absent, th ...[truncated 1149 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The verify-image action posts base64-encoded invoice image content to the remote verification API, but the code does not display any warning, confirmation, or explanatory comment that image data will leave the local system. Since invoice images can contain sensitive financial information, users should be clearly informed before upload.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README presents all instructions, trigger phrases, and usage guidance only in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill discloses network access to a remote invoice-verification service and writes local configuration/identity files, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a permission-transparency gap: users and the host agent may not have clear policy boundaries around network and local-environment interactions, increasing the chance of unintended data exfiltration or overbroad execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The initialization phrase '帮我初始化' is broad and resembles normal conversational language, so it may be triggered unintentionally in routine chat. In this skill, initialization causes persistent local writes and automatic API key generation, making accidental activation more sensitive than a harmless setup step.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill enables implicit invocation without any visible trigger constraints, so the agent may invoke invoice-related actions in response to loosely related user requests. In this skill, that increases the chance of unintentional disclosure of invoice data to the external service and accidental progression toward state-changing actions such as configuration initialization or order workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Multiple user-visible strings, labels, and descriptions are hardcoded in Chinese, including invoice type descriptions and field guidance, with no indication that the tool is region-specific or that users can choose another language. This can violate a language/locale policy when a skill imposes a specific language without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill persistently stores the app key and stable device identifiers in plaintext JSON files under the user's home directory. If another local process, user, backup system, or malware can read those files, it can recover authentication material and tracking identifiers, enabling unauthorized API use and long-lived correlation of the device across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The verify action sends user-provided invoice text to a remote endpoint via callApi, and the code does not provide a confirmation prompt, warning message, or comment/docstring disclosing that potentially sensitive invoice data is being transmitted off-host. Because invoice contents can include financial and personal data, this network transmission should be explicitly disclosed to users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The default prompt requires the agent to reply with fixed Chinese phrases such as '帮我安装这个技能' and '帮我初始化' without offering the user a language choice. This is a natural-language locale policy concern because it imposes a specific language rather than allowing opt-in or documenting a justified locale restriction.
- Content
Static analysis
No suspicious patterns detected.