invoice-auto-forward@1.0.10
CAUTION· static onlyPublisher claims: "自动扫描邮箱（支持 QQ/163/126 等主流邮箱，provider 一键切换）里的发票邮件，解析发票（PDF/OFD/XML 三种格式）后按标准化模板转发给指定收件人（如财务/行政），支持抬头白名单过滤、定时无人值守运行、发送节奏控制（防反垃圾风控）。对「链接型发票」（邮件只有下载链接、无 PDF 附件，如腾讯云电子发票）也能自动扫描正文链接并下载发票文件（PDF/OFD/XML）后转发。This skill should be used when 用户想把邮箱收到的发票自动转发给他人、设置发票自动归档/报销流程、配置发票转发规则（授权码/收件人/主题模板），或触发词包括：发票转发、发票自动转发、QQ邮箱发票、163邮箱发票、126邮箱发票、链接型发票、OFD发票、XML发票、转发发票给财务、invoice forward。" Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
- 凭证：~/.workbuddy/secrets/invoice-forward.env（chmod 600；禁止把授权码打印到聊天或日志）Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.- 凭证安全：secrets 文件 chmod 600；也支持环境变量 `MAIL_USER`/`MAIL_AUTH_CODE` 临时传入（优先级高于 secrets 文件，便于隔离验证 / CI，授权码免落盘）；排查问题时不得把授权码打印到聊天或日志。Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.把上面步骤 2–5 合并成一条命令：自动合并已有配置、应用你给的参数、交互补缺失项、验证 IMAP/SMTP 连通性，**确认授权码真能用后才写入 secrets（chmod 600）与 config.json**。凭证绝不会写进 config.json。Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.…eshooting.md）。这些值与转发规则可**一次性交给 `setup` 子命令**完成（推荐，见下方「一键配置」），它会验证连通性后写入 secrets（chmod 600）+ config.json，无需手工改文件。**授权码只进 secrets 文件，绝不写入 config.json、SKILL.md 或任何 skill…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.r = subprocess.run([sys.executable, "-m", "pip", "install", "pdfplumber", "pymupdf"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.chmod 600），字段 MAIL_USER / MAIL_AUTH_CODE。绝不写入 config 或 skill 包。Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.- 发送节奏（防反垃圾风控）：`config.json` 的 `send` 段可设 `interval`（每封最小间隔秒）、`jitter`（额外随机秒上限）、`batch_limit`（单批上限，超出下轮续跑）。QQ 默认 0 即可；163/126 等严格风控邮箱建议 `interval>=3`、`batch_limit<=20`，主题模板建议加 `{invoice_no}` 提升区分度。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.config.json + secrets（chmod 600），省去手动改文件Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim songhonglei: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.