发票查验

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.1

Overview

This invoice-checking skill appears purpose-aligned, but it asks users to share an API key in chat and persist it in plaintext while sending sensitive invoice data to an external service.

Review this skill before installing. Use it only if you are comfortable sending invoice files, invoice metadata, and account credentials to skill.quandianfapiao.com. Do not paste production API keys into chat or store them in shell startup files; prefer a temporary environment variable, a secret manager, or a throwaway/restricted key, and rotate any key matching the example if it was ever real.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:124

Finding

API Key Solicitation and Persistent Plaintext Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 124 and 137–138
Vulnerability Type: Plaintext secret exposure and insecure credential persistence
Risk Level: High

Vulnerable Snippet

bash

setx ZXT_API_KEY <apiKey>
export ZXT_API_KEY=<apiKey>

The instructions additionally direct the agent to append the following assignment to the user's ~/.bashrc or ~/.zshrc:

bash

export ZXT_API_KEY=<apiKey>

They also instruct the user to send the copied API key to the agent.

Technical Analysis

The Skill requires an API key for its legitimate invoice-verification service. However, the documented setup procedure asks the user to disclose the key through the conversation and directs the agent to persist it in plaintext.

On Windows, setx places the credential in a persistent user-level environment variable. On macOS and Linux, appending an export statement to a shell initialization file stores the key directly in a plaintext profile. These mechanisms expose the credential more broadly and for longer than necessary.

The implementation already supports the --api-key argument and a session environment variable, so modifying persistent shell configuration is not required for the declared functionality. A session-scoped variable, hidden prompt, protected configuration file, or operating-system credential manager would provide the required authentication with less exposure.

Attack Path

1. The Skill asks the user to send an API key through the agent conversation.
2. The key may consequently be retained in conversation logs or agent execution records.
3. The agent writes the key to a persistent user environment variable or plaintext shell initialization file.
4. Malware, another process running under the user account, a profile backup, a diagnostic bundle, or a party with access to conversation history retrieves the credential.
5. The attacker uses the recovere ...[truncated 816 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not instruct users to transmit API keys through ordinary conversation messages.
2. Accept credentials through a hidden interactive prompt, protected secret-injection mechanism, or operating-system credential manager.
3. Use session-scoped environment variables by default and avoid setx or modifications to .bashrc and .zshrc.
4. If persistence is explicitly requested, obtain informed user consent and use Windows Credential Manager, macOS Keychain, or an appropriate Linux secret service.
5. Avoid passing keys through command-line arguments where practical because command lines may be exposed through process listings or shell history.
6. Document how users can revoke and rotate the key and remove any previously persisted plaintext values.
7. Ensure logs and error messages redact API keys.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:406

Finding

API-Key-Like Credential Embedded in Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 406
Vulnerability Type: Hardcoded secret or live-looking credential disclosure
Risk Level: Medium

Vulnerable Snippet

json

{
  "data": {
    "apiKey": "sk-sg-9EVbsJLJnlKVLaSO4FZtPUVFysbFL",
    "invoiceNumber": "26127000000211930033",
    "invoiceDate": "2026-05-12",
    "jejym": "162.43"
  }
}

Technical Analysis

The documentation contains a concrete API-key-like value rather than an unmistakable placeholder. Static analysis cannot establish whether this credential remains valid, but its format and placement are consistent with a usable service credential.

Committing secrets to Skill documentation distributes them to every recipient of the package and may also preserve them indefinitely in source-control history, caches, mirrors, and audit artifacts. Removing the value from the current file is insufficient if it was previously published or committed.

Attack Path

1. An attacker obtains the Skill package or accesses its source repository.
2. The attacker reads the request example and extracts the embedded API-key-like value.
3. The attacker submits requests to the documented service endpoint using that value.
4. If the credential is valid, the service attributes the requests to the credential owner.
5. The attacker consumes available quota or uses any invoice-verification and record-query permissions granted to the associated account.

Impact Assessment

If valid, the credential could permit unauthorized use of the associated service account, consumption of paid or limited API quota, and access to any invoice records exposed under that account.

The exact permissions and current validity cannot be confirmed through static review. Consequently, the maximum impact is bounded by the service-side privileges assigned to this key, but the value must be treated as compromised until it is verified as a nonfunctional example ...[truncated 11 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke or rotate the exposed value if it was ever a valid credential.
2. Replace it with an unmistakable placeholder such as YOUR_API_KEY.
3. Search source-control history, release archives, logs, and package registries for the exposed value and purge it where feasible.
4. Review service logs for unauthorized activity associated with the credential.
5. Add automated secret scanning to commits and release pipelines.
6. Use synthetic, nonfunctional values in all documentation and test fixtures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires environment-variable access and remote network calls, but it does not declare an explicit tool scope such as permissions or allowed-tools. That increases the risk of overbroad agent execution because the runtime may permit more capabilities than users or reviewers expect, especially given the skill also handles credentials and local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description encourages users to upload invoice files and submit invoice details, but it does not warn that these materials are sent to a third-party remote API. Invoices commonly contain sensitive financial and identity data, so silent transmission creates a meaningful privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to ask the user to send their apiKey directly in chat and then store it for later use. Collecting secrets in normal chat channels raises the chance of retention in conversation logs, unauthorized disclosure to operators or plugins, and accidental reuse beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to persist the user's apiKey into system environment configuration such as setx, ~/.bashrc, or ~/.zshrc without a clear warning about long-term credential storage. Persisting secrets in shell startup files or user environment variables increases exposure to other local processes, future sessions, logs, backups, and accidental disclosure.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

返回分页列表，每条记录包含：

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

| 字段          | 说明                                                                                                     |
| ------------- | -------------------------------------------------------------------------------------------------------- |
| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md

| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |
| kprq          | 开票日期                                                                                                 |
| jshj          | 价税合计                                                                                                 |
| cyzt          | 查验状态：0 未查验，1 查验中，2 查验真票，3 查无此票，4 查询不一致，5 查验失败，6 不支持查验，7 抬头不符 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

| invoiceNumber | 发票号码                                                                                                 |
| invoiceCode   | 发票代码                                                                                                 |
| fplx          | 发票类型                                                                                                 |
| fplxName      | 发票类型名称                                                                                             |
| kprq          | 开票日期                                                                                                 |
| jshj          | 价税合计                                                                                                 |
| cyzt          | 查验状态：0 未查验，1 查验中，2 查验真票，3 查无此票，4 查询不一致，5 查验失败，6 不支持查验，7 抬头不符 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md

| cyzt          | 查验状态：0 未查验，1 查验中，2 查验真票，3 查无此票，4 查询不一致，5 查验失败，6 不支持查验，7 抬头不符 |
| cyztName      | 查验状态名称                                                                                             |
| cysj          | 查验时间                                                                                                 |
| xsfMc         | 销售方名称                                                                                               |

### 外层返回字段

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file defines a helper that reads a local file, includes an API key, and uploads both to a remote HTTPS endpoint. There is no confirmation prompt, print/log disclosure, or explanatory comment/docstring near the operation warning that user data and credentials are being transmitted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The inspect function sends invoice metadata such as invoice number, date, code, and amount/check value to a remote API without explicit disclosure to the user that this information is being shared externally. Even without file upload, these fields are sensitive financial records and can reveal billing relationships, transaction timing, and invoice authenticity checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inspect_file path uploads invoice files to a remote API via post_file, but the skill does not provide a clear user-facing disclosure at the point of use that the full document contents will leave the local environment. Because invoices often contain sensitive financial and personal/business data, users may unknowingly transmit regulated or confidential information to a third party service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes this skill as verifying invoice authenticity by invoice fields or uploaded file and returning full invoice information. The added record subcommand queries historical verification records with pagination and time-range filters, which is a broader retrieval/reporting capability not conveyed by the manifest description.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The setup instructions explicitly ask the user to send their API key to the assistant so it can configure and run the skill. This trains users to disclose a secret credential through the conversational channel, creating a direct credential-handling risk and enabling unauthorized API use if the assistant platform, logs, or intermediaries are exposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

All user-facing description, trigger phrases, required prompts, and operational text are written only in Chinese, and the required output prompt in the execution flow is also fixed in Chinese. There is no indication that the skill is region- or language-restricted, nor any option for user language preference or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The natural-language documentation string is written only in Chinese and presents the skill as a Chinese invoice utility, with no indication that users can choose another language or that the locale restriction is intentional and documented. Under the policy, forcing a specific language or locale without opt-in can be a violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-facing strings, help text, and setup instructions are entirely in Chinese, including the message asking the user to send the apiKey. This imposes a language choice without opt-in or justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.