israeli-e-invoice
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data, such as buyer and seller details or item descriptions, to generate and validate invoices. While this constitutes an attack surface, the
scripts/validate_invoice.pyutility uses strict validation logic (regex for TINs, numeric checks for VAT) and the instructions use structured headers, which helps mitigate the risk of the agent misinterpreting data as instructions. - [EXTERNAL_DOWNLOADS]: The documentation references official Israel Tax Authority (SHAAM) API endpoints (
ita-api.taxes.gov.il,openapi.taxes.gov.il) and research from reputable tax/accounting firms (KPMG, Grant Thornton) for integration and compliance guidance. These references are appropriate for the skill's technical and regulatory domain. - [SAFE]: The skill includes a clear legal disclaimer regarding the use of AI for tax information. The provided Python script is limited to standard library imports (
sys,json,re,datetime) and performs purely algorithmic validation without network or file system write access.
Audit Metadata