Security audit

发票识别

Security checks for vulnerabilities and agentic risk

Overview

This invoice OCR skill does what it claims, but it asks users to give an API key to the assistant and stores it persistently in shell or user environment settings.

Review before installing. Use this only for invoices you are allowed to send to the listed third-party OCR service. Do not paste long-lived API keys into chat; set ZXT_API_KEY yourself in a trusted environment or secret manager, and avoid appending secrets to shell startup files unless you accept that other local processes and future sessions may read them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad everyday requests such as '读取发票内容' and '识别发票文件', which can cause the skill to activate in contexts where the user did not intend a third-party OCR upload. Because the skill processes sensitive financial documents, accidental invocation increases the chance of unintended data disclosure to the external service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to write a user-supplied API key into persistent system or shell environment configuration. Persisting credentials in user environment variables or shell startup files can expose them to other processes, later sessions, logs, shoulder-surfing, or unintended reuse beyond the current task.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill requires uploading invoice files to a remote API but does not provide a clear privacy, confidentiality, or data-handling warning. Invoices commonly contain tax IDs, names, bank details, addresses, and transaction data, so silent transmission to a third party can create significant privacy, compliance, and data-governance risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill uploads invoice files to a remote API endpoint, but the user-facing flow does not clearly warn that potentially sensitive financial documents will be transmitted off-host to a third party. Invoices commonly contain personal, tax, banking, and business data, so silent transmission creates a privacy and data-governance risk even if the API is legitimate.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The setup text explicitly tells the user to send their API key to the assistant so the assistant can configure and execute the skill. This encourages credential disclosure to an intermediary agent, which breaks basic secret-handling practices and can lead to account compromise, unauthorized API usage, and loss of auditability.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The user-facing instructions normalize handing an apiKey directly to the agent for configuration and execution. This is dangerous because users may be trained to disclose secrets in conversation, and any logging, retention, or compromise of the assistant channel could expose the credential.

Static analysis

No suspicious patterns detected.