Security audit

InvoiceGuard Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does invoice checking, but it needs review because it overstates official tax verification and under-discloses external storage of sensitive invoice data.

Install only if users understand that invoice metadata may be sent to Feishu or a tax-verification service. Treat official tax verification as not implemented until the publisher provides a real integration, and do not rely on generated reports as proof that invoices were officially verified.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill advertises official invoice authenticity verification, but the implementation never performs a real tax-platform check and always returns an unchecked placeholder result. In an invoice compliance and reimbursement workflow, this can cause users or downstream systems to trust unverified invoices, undermining fraud detection and compliance controls.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module claims Pro/Free permission isolation is implemented, but the CLI initializes TierConfig(is_pro=True) by default unless tier data is explicitly provided. This effectively bypasses licensing and access controls for batch and verification-gated features in default CLI use, making the documented control unenforced.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The report marks '发票真实性' based on duplicate/suspicious deduplication results rather than actual authenticity verification status. In an invoice-compliance skill, this can mislead reviewers into treating duplicate-detection output as an official authenticity conclusion, creating compliance, fraud-detection, and business-process risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README describes exporting invoice details into Feishu cloud docs and bitable, but does not clearly disclose that sensitive financial and tax data may be transmitted to an external third-party platform. Because invoice records can contain taxpayer IDs, buyer/seller names, amounts, and dates, insufficient transparency and lack of consent/handling guidance can lead to privacy, compliance, and data governance violations.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger description is broad enough to activate on many ordinary finance-related requests, which can cause the skill to engage unexpectedly and process sensitive invoice or tax data when the user did not explicitly ask for this workflow. In this context, the risk is elevated because the skill can route data into OCR, tax-verification, and reporting flows, increasing the chance of unintended data handling and external transmission.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill describes sending invoice contents to external tax-platform and Feishu services but does not clearly require user consent, disclose what fields are transmitted, or warn about privacy and integrity implications. Because invoices commonly contain company tax IDs, names, amounts, and transaction details, silent transmission to third parties can create confidentiality, compliance, and data-governance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly describes sending invoice fields to an external tax-verification endpoint but does not clearly warn the user at the point of use that invoice data will leave the sandbox and be disclosed to a third party. Invoice metadata can contain sensitive business and personal information, so silent transmission creates a privacy and compliance risk even if the endpoint is an official government service.

Static analysis

No suspicious patterns detected.