Fähigkeiten invoice-winning-numbers
📦
invoice-winning-numbers
Inhaltsrevision r1 Mittleres Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff
Check Taiwan Invoice Winning Numbers
Checking Taiwan invoices manually can miss prize matches or use the wrong draw period. This skill guides official-source lookups, batch comparisons, and cloud prize verification.
Unterstützt: Claude Codex Code(CC)
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "invoice-winning-numbers" from https://skillstore.io/skills/tahodev-invoice-winning-numbers.md and its manifest at https://skillstore.io/api/skills/tahodev-invoice-winning-numbers/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„invoice-winning-numbers“ wird verwendet. Show the skill's historical example for the July-August 2026 draw.
Erwartetes Ergebnis:
- Historical illustration from SKILL.md, not a live lookup: period 115 year, July-August.
- Special prize: 38548029. Grand prize: 10138845.
- First prizes: 24121106, 28589937, and 83663333. No additional sixth prize appears in this example.
- Estimated claim window: October 6, 2026, through January 5, 2027. Confirm with the official platform.
- Source to verify: https://invoice.etax.nat.gov.tw/lastNumber.html.
„invoice-winning-numbers“ wird verwendet. Using the documented May-June 2026 first-prize number 07225810, compare invoices 07225810 and 99999810.
Erwartetes Ergebnis:
- Illustrative comparison only, not a live result or eligibility confirmation.
- Invoice 07225810: first prize, NT$200,000, based on the documented complete match.
- Invoice 99999810: sixth prize, NT$200, based on the documented three-digit suffix 810.
- Verify both invoices belong to this issue period before claiming. Source to verify: https://invoice.etax.nat.gov.tw/lastNumber.html.
Sicherheitsaudit
Mittleres Risikov1 • 13.10.2026 Versionsbericht öffnen
The 19 backtick alerts, eight URL alerts, and two entropy alerts are false positives involving Markdown, official public sources, and readable multilingual text. Seven temporary-file alerts identify predictable shared paths that permit local tampering or symlink-based overwrites. Automatic rechecking also lacks explicit consent and can misuse carrier suffixes or reuse invoice numbers across periods; no credential exfiltration evidence was found.
1
Gescannte Dateien
158
Analysierte Zeilen
7
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Mittel
Recurring Actions Without Explicit Consent
Line 144 says the agent may schedule rechecking itself ('代理可自行排定') after receiving invoice numbers or carrier suffixes. This expands a prior lookup into recurring processing without explicit scheduling or retention consent.
Both the Chinese workflow and English summary authorize proactive rechecking of saved identifiers. No explicit opt-in, retention limit, or cancellation requirement appears.
Mittel
Invalid Inputs and Period Reuse in Automatic Matching
Line 144 allows fixed invoice numbers or carrier suffixes to trigger rechecking every draw. Carrier suffixes cannot identify invoices, and reusing invoice numbers across periods can report invalid wins.
The matching instructions require complete eight-digit numbers or ten-character cloud serials. Automatic guidance nevertheless accepts carrier suffixes and omits invoice issue-period checks.
Elemente der Fähigkeitsprüfung (7)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Mittel
Temp directory access
curl -sm 30 https://invoice.etax.nat.gov.tw/lastNumber.html -o /tmp/lastNumber.html
curl writes to a predictable shared temporary filename without private-directory isolation. A local attacker can pre-create a symlink to overwrite another agent-writable file.
Mittel
Temp directory access
h = open('/tmp/lastNumber.html', encoding='utf-8').read()
The parser trusts a predictable shared temporary file without ownership or isolation checks. Another local user can replace its contents and falsify prize results.
Mittel
Temp directory access
h = open('/tmp/lastNumber.html', encoding='utf-8').read()
Batch matching reads the same predictable shared file without establishing trusted provenance. Local file replacement can produce false winning or losing results.
Mittel
Temp directory access
curl -sm 30 https://invoice.etax.nat.gov.tw/cloudNowNumber.html -o /tmp/cloud.html
curl writes the cloud-prize page to a predictable shared filename. A pre-created symlink can redirect the write to another agent-writable file.
Mittel
Temp directory access
grep -oE 'pdf/[^"]+\.pdf' /tmp/cloud.html | sort -u
PDF link extraction trusts a predictable shared file that another local user can replace. Tampering can substitute prize-document paths and compromise subsequent matching.
Mittel
Temp directory access
curl -sm 30 'https://invoice.etax.nat.gov.tw/pdf/<檔名>.pdf' -o /tmp/prize.pdf
The PDF download writes to a fixed shared temporary path. A pre-created symlink can overwrite an unrelated file writable by the agent.
Mittel
Temp directory access
pdftotext /tmp/prize.pdf /tmp/prize.txt
pdftotext reads a predictable PDF path and writes a predictable text path. Local replacement can tamper with inputs, while output symlinks can redirect writes.
Risikofaktoren
⚙️ Externe Befehle (19)
🌐 Netzwerkzugriff (8)
📁 Dateisystemzugriff (7)
Geprüft von: codex
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/tahodev-invoice-winning-numbers/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/tahodev-invoice-winning-numbers?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/tahodev-invoice-winning-numbers?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tahodev-invoice-winning-numbers/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/tahodev-invoice-winning-numbers.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
tahodev. (2026). invoice-winning-numbers security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tahodev-invoice-winning-numbers/audits/1BibTeX-Zitat
@techreport{tahodev-tahodev-invoice-winning-numbers-2026,
author = {tahodev},
title = {invoice-winning-numbers security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/tahodev-invoice-winning-numbers/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "invoice-winning-numbers security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "tahodev"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/tahodev-invoice-winning-numbers/audits/1"
identifiers:
- type: other
value: "skillstore:tahodev-invoice-winning-numbers:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Mittel 55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
83
Spezifikationskonformität
Was Sie erstellen können
Check Household Receipts
Compare several receipts from one draw period and report each highest matching prize.
Verify Cloud Invoice Prizes
Check complete cloud invoice serials against official PDF lists and confirm the prize category from each document header.
Review Historical Draw Sources
Locate official historical draw references and distinguish downloadable cloud prize lists from regular draws needing manual confirmation.
Diese Prompts ausprobieren
Find the Latest Draw
Find the latest Taiwan invoice winning numbers. Include the draw period, official source, and claim window. Mark any estimated deadline.
Check Several Invoices
Check [eight-digit invoice numbers] for [issue period]. Preserve leading zeros. Report each highest prize and verify the draw period before comparing.
Verify a Cloud Invoice
Check cloud invoice [two-letter prefix and eight digits] for [issue period]. Use official PDF lists and confirm full-serial matches and prize headers.
Plan an Approved Recheck
Plan one recheck for [invoice numbers and issue period] after its draw. Ask before scheduling or retaining identifiers, and specify expiry and cancellation.
Bewährte Praktiken
- Preserve leading zeros and verify each invoice's issue period before matching.
- Use fresh official sources and confirm claim deadlines and cloud prize document headers.
- Use private temporary storage and obtain explicit approval before retaining identifiers or scheduling recurring checks.
Vermeiden
- Treating historical examples, cached pages, or estimated deadlines as current official results.
- Matching carrier suffixes or partial cloud serials as though they were complete invoice identifiers.
- Rechecking saved numbers across unrelated periods or creating recurring tasks without explicit permission.
Häufig gestellte Fragen
Do I need an API key or login?
No. The documented workflow downloads public official pages and prize PDFs without credentials.
Can I check several invoices together?
Yes. The skill includes batch comparison guidance and reports the highest matching prize for each invoice.
What is needed for cloud invoice prizes?
Provide the full two-letter prefix and eight digits. Cloud prizes require exact serial matches and eligibility confirmation.
Can it retrieve historical winning numbers?
Historical cloud prize lists are downloadable. Historical regular draws require manual confirmation through official tax-portal links.
Does it automatically schedule future checks?
No scheduler is included. Scheduled checks require external tooling, explicit approval, identifier retention limits, and correct issue-period matching.
What happens if a page cannot be parsed?
The instructions require stopping and directing you to the official site. The skill should not invent results or present stale data.