invoice-risk-scan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:19 PM UTC
• Version: 1.0.0

Overview

The skill itself is a small local invoice checker, but its documented install path asks users to run an unpinned npx installer and install mutable repository content globally into agent skill directories.

Install only from a reviewed commit or signed release, avoid the global `-g` install path unless you want this skill active across agent projects, and treat PASS results as a preliminary check because the bundled validation has known edge cases.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82
• Finding: Unpinned External Package Execution and Mutable Global Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82-85` **Vulnerability Type**: Unpinned third-party package and mutable repository installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git ``` ### Technical Analysis The documented installation procedure invokes the `skills` npm package through `npx` without specifying an exact package version or integrity digest. Depending on local npm behavior and cache state, this can download and execute the package version currently resolved by the registry. The command also globally installs a skill obtained from a mutable repository reference. The repository is cloned without a commit hash, signed tag, or checksum, so its contents can change after this artifact has been audited. Consequently, the effective code and skill instructions installed by users are not necessarily the same as the reviewed files. The repository clone alone does not execute code. However, the documented workflow copies the downloaded skill into an Agent skill directory, after which its instructions or scripts may be loaded or invoked. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the source repository, or an associated release process. 2. The attacker publishes a modified package or changes the repository's default branch. 3. A user follows the documented `npx skills add ... -g` or `git clone` installation procedure. 4. `npx` executes the newly resolved package, or mutable repository content is copied into the Agent's skill directory. 5. Malicious code or instructions execute with the installing user's privileges when installation occurs or when the installed skill is subsequently loaded. ### Impact Assessment A compromised npm installer could execute arbitrary commands with the privileges of the user running `npx`. A compromised skill repository could in ...[truncated 462 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to an audited version, such as `npx skills@<exact-version>`, and use a lockfile where applicable. 2. Publish and verify a cryptographic integrity digest or signed release before executing the installer. 3. Pin repository installation to a reviewed commit hash rather than the default branch. 4. Prefer a signed release archive with a documented SHA-256 checksum. 5. Avoid global installation by default. Install into a project-specific, least-privileged skill directory. 6. Require users to review downloaded scripts and skill instructions before activation. 7. Document the exact package version, repository commit, and expected file hashes used to produce this audited artifact. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/invoice_risk_scan.py:22
• Finding: Non-Finite Invoice Amounts Can Receive a PASS Result<![CDATA[ ## Vulnerability Details **File Location**: `scripts/invoice_risk_scan.py:22` **Vulnerability Type**: Incomplete numeric input validation **Risk Level**: Low ### Vulnerable Code ```python ok = a.amount > 0 ``` ### Technical Analysis The amount is parsed as a Python floating-point value and validation only checks whether it is greater than zero. Python accepts special floating-point values such as positive infinity from textual input. Positive infinity compares greater than zero, so it is treated as a valid invoice amount. For example, an invocation using `--amount inf` can satisfy this check, leave the problem list empty, produce a PASS result, and exit with status code 0. This conflicts with the tool's role as an invoice pre-screening gate because infinity is not a valid monetary amount. Floating-point values are also generally unsuitable for exact financial calculations due to binary rounding, although the current code only checks positivity. ### Attack Path 1. A caller supplies `--amount inf`. 2. Argument parsing converts the value to positive floating-point infinity. 3. The expression `a.amount > 0` evaluates to true. 4. No amount-related problem is recorded. 5. If no other supplied field fails, the script reports PASS and exits with status code 0. 6. Downstream automation relying on the exit code may accept the malformed invoice record. ### Impact Assessment The issue enables bypass of the amount-validity check and can cause malformed invoice data to be marked as compliant. It does not grant code execution, file access, additional operating-system privileges, or direct access to sensitive data. The affected scope is the integrity of screening decisions and any downstream workflow that treats exit code 0 or the JSON `pass` field as authoritative. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject non-finite values before checking positivity: ```python import math ok = math.isfinite(a.amount) and a.amount > 0 ``` 2. Prefer `decimal.Decimal` for monetary input and reject `NaN`, infinity, and unsupported precision explicitly. 3. Define acceptable maximum values and decimal precision according to the invoice format. 4. Add tests for `inf`, `+inf`, `-inf`, `nan`, zero, negative values, excessively large values, and excessive fractional precision. 5. Return a clear validation error when a non-finite amount is supplied. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/invoice_risk_scan.py:27
• Finding: Impossible Calendar Dates Can Receive a PASS Result<![CDATA[ ## Vulnerability Details **File Location**: `scripts/invoice_risk_scan.py:27-30` **Vulnerability Type**: Incomplete date validation **Risk Level**: Low ### Vulnerable Code ```python ok = bool(re.match(r"^\d{4}-\d{2}-\d{2}$", a.date)) if ok: y = int(a.date[:4]) ok = 2000 <= y <= 2035 ``` ### Technical Analysis The date check validates only the textual `YYYY-MM-DD` shape and whether the year is between 2000 and 2035. It does not validate whether the month and day form a real calendar date. Inputs such as `2025-99-99`, `2025-02-30`, or `2023-02-29` satisfy the regular expression and year-range test even though they are not valid dates. Such values can therefore produce a PASS result and status code 0. The check also does not compare the invoice date with the current date or another business-defined acceptable period. The confirmed bypass, however, is the acceptance of impossible calendar dates. ### Attack Path 1. A caller supplies a syntactically shaped but impossible date, such as `--date 2025-99-99`. 2. The regular expression accepts the value because it contains four digits, two digits, and two digits in the expected positions. 3. The extracted year, 2025, falls within the permitted range. 4. No date-related problem is recorded. 5. If no other supplied field fails, the script reports PASS and exits with status code 0. 6. Downstream reimbursement or accounting automation may accept an invoice with an invalid date. ### Impact Assessment The issue compromises the integrity and reliability of the invoice-screening result. An attacker or malformed upstream system can bypass the date-validity gate without obtaining any additional system privilege. The affected scope is limited to screening decisions and downstream systems that rely on the script's PASS result, JSON output, or exit status. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the complete value with a calendar-aware standard-library function: ```python from datetime import date try: parsed_date = date.fromisoformat(a.date) ok = 2000 <= parsed_date.year <= 2035 except ValueError: ok = False ``` 2. If the policy requires date reasonableness, compare the parsed date with the current date and define an explicit permitted historical or future range. 3. Add tests for invalid months, invalid days, leap years, non-leap years, malformed separators, and boundary years. 4. Keep the existing deterministic failure behavior and return a specific message distinguishing invalid format from an impossible calendar date. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The natural-language instructions, usage guidance, warnings, and operational content are presented only in Chinese, aside from a few labels. This can amount to a language policy violation when the skill effectively forces a specific language for safe use without explicitly offering the user an alternative language or opt-in.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The documentation instructs users to run `npx skills` without pinning an exact package version or otherwise constraining what code is fetched and executed. Because `npx` can download and run the latest published package, a compromised package, typo-squatted package, or malicious upstream update could result in arbitrary code execution on the user's machine during installation or use.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The English summary states "One-command pre-screening for 金融/财税," which forces Chinese terminology into the English-facing description rather than providing a full language-localized option. This can be read as a language/locale policy issue because the file presents bilingual content but does not give users a clear opt-in or fully consistent language choice for the English path.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The manifest sets the category to "AI 治理", which imposes a Chinese-language label in skill metadata. Because the file does not indicate that the skill is intended only for Chinese-speaking users or offer any language/locale choice, this may violate the policy against forcing a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The user-facing natural-language strings in the argument parser description, help text, and error message are all in Chinese, which effectively requires Chinese-language interaction. This is a locale/language constraint presented without any opt-in or alternative language option.

Static analysis

No suspicious patterns detected.