Invoice Automation
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as customer details and line item descriptions which are interpolated into invoice templates. This creates a potential surface for indirect prompt injection if an attacker provides malicious instructions within customer records.
- Ingestion points: Ingests untrusted data through customer/client fields and line items in SKILL.md.
- Boundary markers: Absent; data is directly interpolated into markdown templates without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: Performs API operations on financial platforms (QuickBooks, Xero, Stripe) via the 'accounting-mcp' server.
- Sanitization: No explicit sanitization or validation of the ingested strings is defined within the skill content.
- [SAFE]: The skill exhibits legitimate business functionality aligned with its stated purpose. All external integrations are conducted through official MCP tools for well-known financial services. No hardcoded credentials, obfuscation, or unauthorized data exfiltration patterns were identified.
Audit Metadata