Security audit

发票查重

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform invoice deduplication as advertised, but it under-scopes sensitive credential and invoice-data handling enough that users should review it carefully before installing.

Install only if you are comfortable sending invoice metadata to the named external service and can configure credentials through a safer local secret mechanism. Do not paste API keys into chat; prefer a dedicated secret store or short-lived environment variable, and confirm whether your organization allows invoice data to be processed by that third party.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs storing a user-provided API key into persistent user shell configuration or environment storage, which can leave credentials exposed to other local processes, future sessions, shell history, or other skills. Persisting secrets without a warning, scope limitation, or safer secret-store option unnecessarily increases the blast radius of credential compromise.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill processes invoice numbers, dates, and possibly amounts, then sends them to a third-party remote API for deduplication, but the description does not warn users that potentially sensitive financial/business data will leave the local environment. This lack of disclosure can cause unintended privacy, compliance, or contractual violations when users invoke the skill expecting only local processing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly tells the user to send their API key to the agent so the agent can configure and run the skill. This creates unnecessary credential disclosure risk because the secret is being transmitted through a conversational channel rather than being entered directly into a dedicated secret input or local environment variable.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The code instructs the user to provide their API key directly to the agent, which normalizes insecure credential-sharing behavior. If followed, the secret may be exposed in chat logs, agent memory, telemetry, or operator-visible systems, increasing the chance of account compromise or misuse of the external invoice service.

Static analysis

No suspicious patterns detected.