Security audit

发票认证

Security checks for vulnerabilities and agentic risk

Overview

This tax-invoice skill does what it says, but it handles tax credentials and invoice actions in ways users should review carefully before installing.

Install only if you are comfortable giving this skill authority over sensitive tax-invoice workflows and using the skill.quandianfapiao.com service. Avoid sending apiKeys or passwords in chat, avoid command-line password arguments, remove any saved .session file after use, and prefer short-lived or manually supplied credentials over persistent shell configuration.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill stores highly sensitive tax-login credentials, including the password and API key, in a local `.session` file in plaintext. In a tax-operation context, these secrets can enable unauthorized login, invoice certification actions, and access to taxpayer data if the host or workspace is accessible to other users or processes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs storing a user-provided apiKey in persistent shell startup files or user-level environment variables, which can expose the credential to other local processes, future sessions, shell history/workflow mistakes, or other tools that read environment configuration. Because this is a tax-related credential, persistence materially increases blast radius if the host is shared or later compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill handles highly sensitive tax and account data, including tax ID, account, password, SMS code, invoice data, and signing-related actions, and sends them to a third-party remote service without an explicit privacy, retention, and transmission warning. In this context, users may not realize that regulated financial and identity data is leaving the local environment, creating risks of credential compromise, privacy violations, and unauthorized tax actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The function uploads arbitrary local file contents together with an API key to a hard-coded remote domain, and this file contains no consent prompt, disclosure, allowlist, or verification of what data may be sent. In the context of a tax-invoice skill, uploaded files can contain highly sensitive financial and taxpayer information, so silent exfiltration to an external service materially increases confidentiality and credential exposure risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code silently writes tax account credentials and the API key to a local session file without any visible warning, consent flow, or file-permission hardening. This is dangerous because users may not realize long-lived credentials are being retained on disk, creating a straightforward credential theft opportunity on shared or compromised systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The auto-login path loads stored account credentials and retransmits them to the remote login endpoint without an explicit user action at the time of use. In this tax-administration context, silent reauthentication increases the blast radius of local secret compromise and may cause sensitive actions to proceed under an unexpectedly restored session.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The skill explicitly tells the user to send their API key to the assistant for configuration and execution, encouraging disclosure of a credential to an intermediary. This violates safe secret-handling practice and can lead to unauthorized use of the user's tax-service API access if the assistant, logs, chat history, or integrations are exposed.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The code's user-facing guidance solicits direct submission of the API key to the agent, normalizing unsafe credential transfer. In a financial/tax workflow, this is particularly risky because compromise of the API key could permit access to sensitive invoice and taxpayer operations.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:300