Security audit

发票查验

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks users to share and persist an invoice-service API key and sends sensitive invoice data to a third-party service with limited privacy guidance.

Review before installing. Use this only if you are comfortable sending invoice details and uploaded invoice files to skill.quandianfapiao.com. Do not paste production API keys into chat; prefer setting ZXT_API_KEY yourself in a secure local secret store or temporary environment variable, and avoid adding it to shell startup files unless you understand the exposure risk.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to take a user-supplied API key and persist it into user or shell startup configuration, which expands the credential's lifetime and exposure far beyond a one-time invoice check. Persisting secrets in shell profiles or user environment variables can leak them to other processes, future sessions, logs, backups, or unrelated tools. Because the skill processes financial documents, compromise of this API key could enable unauthorized invoice lookups or data access at scale.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill asks the user to provide an API key and instructs persistence of that credential without clearly warning that it is a sensitive secret. Users may disclose production credentials without understanding reuse, persistence, or cross-process exposure risks. In a financial workflow, poor secret-handling guidance increases the chance of unauthorized access to invoice data and related account misuse.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill encourages uploading invoice files and sending full invoice data to a remote API but does not warn that invoices can contain sensitive financial and personal information. Without disclosure, users may unknowingly transmit taxpayer IDs, names, addresses, bank details, and transaction records to a third party. The skill context makes this more serious because invoices routinely contain regulated or business-confidential data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file-upload path transmits user-supplied invoice documents to a remote API, but this file provides no clear disclosure, consent prompt, or data-handling warning before sending potentially sensitive financial documents. In a skill that processes invoices, this is especially relevant because uploaded files may contain tax identifiers, company details, addresses, and transaction data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Manual verification sends invoice details together with the API credential to a remote service without any visible disclosure in this file. Because invoice data is sensitive business information and the API key is a secret, silent transmission increases the risk of users exposing data or credentials without informed consent.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs the model to solicit an API key from the user and write it into persistent environment variables. That creates an unsafe secret-handling pattern where the agent becomes a credential collection and persistence mechanism, increasing the attack surface and violating least-privilege expectations. In this skill, the risk is amplified because the key enables access to sensitive invoice verification and history-query operations.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The setup text explicitly instructs the user to send their API key to the assistant, which normalizes secret sharing with an intermediary and creates a direct credential-exposure path. This is particularly dangerous because API keys can be reused to access the remote service and potentially retrieve or submit invoice-related data on the user's behalf.

Static analysis

No suspicious patterns detected.