ClawHub
Back to skill

Security audit

百望股份智能发票查验

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed invoice-verification integration that sends selected invoice data to a remote service and stores local configuration, with no artifact-backed evidence of hidden or destructive behavior.

Install only if you are comfortable sending invoice text, invoice images, and same-name .txt companion text to the stated remote invoice-verification service. Use explicit skill-qualified commands, review batch directory paths before running them, confirm recharge amounts before orders, and delete ~/.openclaw/invoice-skill/config.json plus identity.json when you no longer want the local key and identifiers stored.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill explicitly describes network communication with an external service and local configuration/identity file writes, but it does not declare corresponding permissions. That mismatch is a real security issue because users and the platform cannot accurately understand or constrain the skill's capabilities, especially given invoice images/text and local file content may be transmitted off-host.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrase “帮我初始化” is generic enough to overlap with ordinary assistant interactions, which can cause accidental invocation of the skill when a user intended a different action. In this skill, accidental activation is more sensitive than usual because initialization writes local configuration files and generates persistent identifiers, increasing the consequence of a mistaken trigger.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The example invocations use broad phrases like “帮我核验这张发票图片” and “帮我批量核验这个目录里的发票,” which may be matched during normal conversation and unintentionally route sensitive invoice content or local file data to the remote service. This is especially risky here because the README explicitly states that uploaded images, local images, batch directory contents, and same-name .txt supplemental files are sent to an external endpoint, so mis-triggering can lead to unintended data exfiltration and billable actions.

VirusTotal

1/64 vendors flagged this skill as malicious, and 63/64 flagged it as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.