ReceiptExtract - OCR, Photo/PDF to CSV

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:50 AM UTC
• Version: 1.0.1

Overview

This skill does what it says: it uploads user-selected receipt files to ReceiptExtract for parsing, with no hidden persistence or unrelated behavior found.

Before installing, understand that receipt images or PDFs you choose to process will be sent to ReceiptExtract and may include merchant, location, purchase, tax, and payment-related details. Use it only for receipts you are allowed to upload, keep the API token in an environment variable or secret manager, and be careful with bulk or recursive directory processing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares network access, environment-variable secret usage, and file handling behavior, but it does not define an explicit tool/permission scope such as allowed tools or permissions. That creates ambiguity about what execution capabilities the agent may exercise when running the workflow, increasing the risk of overbroad access or unintended actions in environments that rely on declarative scoping for enforcement.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs uploading receipt images and PDFs to a third-party API but does not clearly warn that receipts often contain sensitive personal, financial, location, and transaction data. Users may unknowingly transmit PII or confidential business information off-platform without informed consent, which can create privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to upload receipt images/PDFs to an external API but does not clearly disclose that potentially sensitive financial documents and extracted transaction data are sent to a third-party service. Receipts often contain personal, payment, location, and merchant data, so lack of an explicit privacy/data-sharing warning can lead to uninformed disclosure and improper handling in downstream automations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script sends receipt images/PDFs to a third-party API, and receipts commonly contain sensitive financial and personal data such as merchant history, timestamps, itemized purchases, loyalty identifiers, and partial payment information. Although external upload is core to the feature, the lack of an explicit user-facing warning/consent step creates a real privacy and data-handling risk because users may not realize local files are transmitted off-device to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

req.add_header("Content-Length", str(len(body)))

    try:
        with urllib.request.urlopen(req, data=body) as resp:
            raw = resp.read().decode("utf-8")
            return resp.status, json.loads(raw)
    except urllib.error.HTTPError as e:

• Confidence: 94% confidence
• Finding: This line performs the actual network transmission of the receipt file body to an external endpoint. In this skill context, that behavior is expected, but it still constitutes a genuine data exfiltration surface because highly sensitive receipt documents are sent to a remote service without any additional safeguards such as consent flow, destination verification beyond a hardcoded URL, or minimization of uploaded content.

Static analysis

No suspicious patterns detected.