T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/index.ts:20- Finding
Caller-Controlled Billing Identity Allows Potential Unauthorized Charges
- Content
View full analysis
- Remediation
View remediation
Security audit
MY/SG Invoice & Receipt Parser
Security checks for vulnerabilities and agentic risk
Overview
This paid invoice skill discloses billing, but its endpoint mainly charges a caller-supplied user ID and returns tax rates instead of actually parsing invoices.
Review this skill carefully before installing. It may be acceptable only if you are comfortable with a paid remote call that sends a user identifier and if the SkillPay billing layer independently authenticates users and prevents duplicate or unauthorized charges. Do not rely on this artifact alone for actual invoice OCR or structured document extraction.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims multilingual invoice extraction capability, but the provided implementation details do not show actual OCR, document handling, or extraction logic; instead they focus on tax heuristics and remote tax-rate retrieval. This mismatch is dangerous because it can mislead integrators into trusting unsupported capabilities and obscure the fact that the only concrete action shown is a paid network call.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims multilingual invoice extraction capability, but the provided implementation details do not show actual OCR, document handling, or extraction logic; instead they focus on tax heuristics and remote tax-rate retrieval. This mismatch is dangerous because it can mislead integrators into trusting unsupported capabilities and obscure the fact that the only concrete action shown is a paid network call.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill’s stated purpose is invoice/receipt extraction, but the implementation does not parse invoices at all; it charges the user and returns tax rates instead. This capability mismatch is a strong indicator of deceptive behavior because users or calling systems may invoke the skill expecting document processing while actually triggering billing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to make a network request to an external endpoint, but it does not declare any explicit tool scope or network permission boundaries. This is dangerous because hidden or undeclared network behavior makes it harder for users and platforms to understand that external data transfer and remote side effects can occur, including billing-related actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation tells the agent to POST a user identifier to a remote endpoint that charges billing, but it does not present a clear up-front warning, consent flow, or privacy disclosure. This is dangerous because it can lead to unauthorized paid actions and unnecessary disclosure of user-linked data to a third party before the user understands the consequences.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Charging a user is not necessary for invoice parsing itself, and in this file it appears as the primary operation despite the skill being described as a parser. That unjustified payment capability increases the risk of unauthorized or deceptive monetization, especially in agent ecosystems where skills may be invoked automatically based on descriptions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code accesses billing credentials and initiates a charge without any user-facing disclosure or confirmation in the file’s behavior. In a skill presented as an invoice parser, silent charging is dangerous because it can cause unexpected financial impact and erode trust, even if the billing backend itself is technically functioning as designed.
- Content