green-invoice

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Python helper script (scripts/green-invoice-client.py) that uses standard libraries to interact with the Green Invoice API via command-line arguments. The script is well-structured and follows safe practices for handling API credentials and performing network requests.\n- [EXTERNAL_DOWNLOADS]: References official software packages such as the green-invoice Python package and greeninvoice/greeninvoice Composer package, as well as official vendor documentation at developers.morning.co. These are verified and legitimate resources related to the skill's purpose.\n- [DATA_EXFILTRATION]: The skill is designed to transmit accounting data (invoices, receipts, and client information) to the service provider's official API endpoints (api.greeninvoice.co.il and api.morning.co). These operations are consistent with the skill's primary function and target the legitimate infrastructure of the vendor.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses when querying for documents or clients. The risk is safe because the provided script simply parses the JSON responses and prints the information for the user, without interpolating it into executable logic or new agent instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 09:56 AM