Security audit

发票识别

Security checks for vulnerabilities and agentic risk

Overview

The skill performs invoice OCR as advertised, but it asks users to share an API key in chat and persistently writes it into shell configuration without clear consent or safe secret handling.

Review before installing. Use only with invoices you are allowed to send to skill.quandianfapiao.com, and avoid pasting long-lived API keys into chat or writing them into shell startup files. Prefer a platform secret manager or a per-run environment variable, and do not let the agent automatically modify ~/.bashrc, ~/.zshrc, or persistent user environment settings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:61
Finding: Agent Workflow Hijacking Through Priority and Mandatory-Output Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:70
Finding: Unsafe API-Key Interpolation and Plaintext Persistence in Shell Startup Configuration
Content: View full analysis
export ZXT_API_KEY= ``` On macOS and Linux, it additionally directs the Agent to append the following unquoted assignment to `~/.bashrc` or `~/.zshrc`: ```bash export ZXT_API_KEY= ``` ### Technical Analysis The instructions place a user-provided API-key value directly into shell commands and startup files without quoting, escaping, or format validation. If the value contains shell metacharacters such as command separators, command substitutions, redirections, or newline characters, it can alter the command being executed. For example, an attacker-controlled value containing shell syntax could terminate the intended assignment and append another command. When used in the current shell, that additional command may execute immediately. When written to `~/.bashrc` or `~/.zshrc`, it may execute whenever the user starts a later interactive shell. The approach also stores the API key in plaintext. Depending on execution details, the secret may be exposed through: - Conversation history. - Shell history. - Command-line arguments or process inspection. - User profile and shell startup files. - Backups or synchronization systems that include those files. Persistently modifying shell profiles is not required for a single invoice OCR invocation. The script already supports receiving the key through its process environment or the `--api-key` argument, although command-line arguments also require care because they can be process-visible. ### Attack Path 1. The Agent asks the user to provide an API key as directed by the Skill. 2. An attacker or untrusted user supplies a value containing shell syntax rather than a valid key. 3. The Agent substitutes that valu ...[truncated 1205 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes environment-variable access and a remote OCR API, but it does not declare any explicit tool scope or allowed-tools boundary. This increases the chance an agent can use broader-than-necessary capabilities for file handling, shell access, or network exfiltration without clear user-visible constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs users to upload invoice files to a third-party OCR service without clearly warning that invoices commonly contain sensitive personal, financial, tax, and business information that will leave the local device. Users may unknowingly transmit regulated or confidential data to an external processor.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to request an API key from the user in chat and then store it in environment variables, creating a plain-text secret collection and persistence workflow. Chat channels and environment variables are often insufficiently protected for credential handling, creating risks of disclosure, reuse, or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to persist a user-supplied API key into shell profiles or user environment variables, modifying system configuration and storing a secret locally without an explicit consent or warning. This can leave credentials exposed to other local processes, future sessions, shell history, or unintended users on the machine.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 清单描述聚焦于上传发票文件并返回票面信息，而这里实现了一个可对固定远程域名任意路径发起 JSON POST 的通用客户端，不限于文件 OCR 上传。对于“发票识别”这一受限目的来说，这比描述中声明的能力更宽，属于描述与实际行为不完全一致。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 对于一个发票 OCR 技能，上传文件到识别服务是合理实现细节；但额外暴露按任意路径发送 JSON 的通用网络能力，并非“上传发票文件识别”这一目的的直接最小需求。该能力可被复用于其他远程操作，缺乏从清单目的中得到的充分正当性。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: post_file sends the full local file contents and an API key to an external service, which can include highly sensitive invoice data and credentials. In the context of an invoice OCR skill this transmission is expected, but the code provides no consent notice, destination verification beyond a fixed URL, redaction option, or controls to limit accidental exposure of confidential business information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill uploads invoice files to a remote API endpoint, but the user-facing flow does not clearly warn that potentially sensitive financial documents will leave the local environment. Because invoices often contain company, tax, banking, and personal data, lack of explicit transmission notice can cause unintentional disclosure to a third party.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The setup text instructs the user to send their API key to the agent so the agent can configure and run the skill. Encouraging users to disclose long-lived credentials to an intermediary increases the risk of secret exposure, reuse outside intended scope, logging retention, or misuse if the agent environment is compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The natural-language instructions, prompts, and user interaction text are all presented only in Chinese. This can amount to a language policy issue when a skill effectively forces a specific language without offering user opt-in or documenting that it is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The module docstring is written only in Chinese and presents the skill as a Chinese-language invoice utility, with no indication that users can opt into another language or that the locale restriction is required. Under the policy, fixed language behavior without user opt-in or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings throughout the file, including the module docstring, CLI description, help text, and error/setup guidance, are all fixed in Chinese. This can violate language/locale policy when no user opt-in or justified region-specific limitation is provided.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest describes a skill for uploading invoice files and returning OCR-extracted invoice data. Reading credentials from process environment is an additional capability unrelated to invoice parsing itself and is not mentioned in the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.