green-invoice
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python helper script (
scripts/green-invoice-client.py) that uses standard libraries to interact with the Green Invoice API via command-line arguments. The script is well-structured and follows safe practices for handling API credentials and performing network requests.\n- [EXTERNAL_DOWNLOADS]: References official software packages such as thegreen-invoicePython package andgreeninvoice/greeninvoiceComposer package, as well as official vendor documentation atdevelopers.morning.co. These are verified and legitimate resources related to the skill's purpose.\n- [DATA_EXFILTRATION]: The skill is designed to transmit accounting data (invoices, receipts, and client information) to the service provider's official API endpoints (api.greeninvoice.co.ilandapi.morning.co). These operations are consistent with the skill's primary function and target the legitimate infrastructure of the vendor.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses when querying for documents or clients. The risk is safe because the provided script simply parses the JSON responses and prints the information for the user, without interpolating it into executable logic or new agent instructions.
Audit Metadata