Security audit

百望股份智能发票查验

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do the invoice-checking work it advertises, but it handles sensitive invoice data and credentials with under-scoped controls that users should review before installing.

Install only if you are comfortable sending invoice text, images, and optional sidecar .txt contents to the documented remote service. Review the configured API base URL before use, avoid custom endpoints unless you trust them, protect or delete ~/.openclaw/invoice-skill when no longer needed, and require explicit confirmation before batch uploads or recharge orders.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/invoice_service.js:185
Finding: Bearer Credential Stored Without Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/invoice_service.js:202
Finding: Arbitrary API Endpoint Can Receive Bearer Credentials and Sensitive Invoice Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/invoice_service.js:1528
Finding: Recharge Order Terms Are Accepted by Default Without Executable Consent Enforcement
Content: View full analysis
` without supplying `--agree-terms true`. 2. The implementation assigns `true` to `agreeTerms`. 3. The Skill sends a `POST` request to `/api/v4/plugin/orders`. 4. The backend receives the request as though the caller had accepted the relevant terms. 5. A recharge order and payment instructions may be generated without executable proof of affirmative consent. This issue does not show that payment is automatically completed. The returned payment page or QR code appears to require a subsequent user action, which limits the direct finan ...[truncated 618 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: All example invocations and operational instructions are written as mandatory Chinese phrases such as “帮我初始化” and “帮我核验…”, with no indication that other languages are supported or that Chinese is a required locale. This creates a natural-language locale constraint without user opt-in, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly discloses network use to a third-party endpoint and local writes to ~/.openclaw/invoice-skill/, but it does not declare any tool scope such as allowed-tools or permissions. That mismatch weakens platform-level consent and containment, because a user or runner cannot reliably see or enforce that the skill needs network and local file/config access before execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables implicit invocation without a tightly scoped activation description, which increases the chance the agent will auto-select this skill for loosely related invoice, billing, image, or order-management requests. In this skill's context, that matters because invocation can trigger external data transmission and local configuration writes, so an overly broad auto-activation path raises the risk of unintended sensitive data exposure or unintended commercial actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code sends invoice text and image content to an external service via /api/v4/plugin/verify, including potentially sensitive billing data and uploaded invoice images. Although the skill description mentions external service disclosure, the runtime code provides no explicit consent prompt, warning, destination confirmation, or redaction controls before transmitting financial documents off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Batch verification persists per-file results and summaries to disk, potentially including invoice metadata, verification outcomes, paths, and API response content in predictable locations under the source directory. This creates a local data exposure risk because sensitive financial information may remain on disk longer than expected and be accessible to other local users, backup systems, or later processes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The usage section presents all activation and operation phrases exclusively in Chinese, such as “帮我初始化” and “帮我核验这张发票图片,” with no indication that users may interact in other languages. The policy for this audit flags language or locale constraints when they are imposed without user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file hardcodes Chinese invoice type descriptions, Chinese field labels, and China-specific invoice parsing logic, making the skill operate around a specific language/locale. There is no natural-language notice in the file that this is a China-specific skill or that users are opting into a Chinese locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.