技能 receipt-scanning-tools
📦
receipt-scanning-tools
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數
管理非營利組織收據掃描
收據工作流程通常需要在多個指令碼之間進行手動輸入、OCR 設定和資料庫檢查。此技能為操作人員提供收據工具專案專屬的命令、結構描述和疑難排解步驟。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "receipt-scanning-tools" from https://skillstore.io/skills/egadams-receipt-scanning-tools.md and its manifest at https://skillstore.io/api/skills/egadams-receipt-scanning-tools/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「receipt-scanning-tools」。 I need to add a grocery receipt for last week.
預期結果:
助理會詢問商家、金額、日期、支出類別和最終核准。接著只有在確認後，才會引導使用者前往手動輸入工具。
正在使用「receipt-scanning-tools」。 The receipt tool says category_path does not exist.
預期結果:
助理會解釋 categories 資料表儲存名稱和父層識別碼。它會建議從階層建立路徑，而不是使用不存在的欄位。
正在使用「receipt-scanning-tools」。 I want to remove duplicate expenses from one date.
預期結果:
助理會建議先檢視近期支出、備份資料，並在使用刪除工作流程前確認確切刪除條件。
安全審計
高風險v8 • 2026/7/5 開啟版本化報告
Most external command and system reconnaissance alerts are false positives caused by Markdown code fences, inline paths, and SQL examples. Confirmed risks remain for machine-specific hidden filesystem paths, .env credential guidance, and direct access to nonprofit finance database records. No prompt injection attempt was found, but the skill exposes personal finance context and includes destructive database workflows.
1
已掃描檔案
455
分析行數
6
複核項目
0
已忽略的誤報
已確認的安全問題 (15)
高
Environment file access
# Environment variables in .env file
The skill points users or agents to a .env file that stores database and API credentials. Reading that file can expose secrets even though no exfiltration intent is shown.
高
Environment file access
1. Check DB connection settings in `.env`
The skill points users or agents to a .env file that stores database and API credentials. Reading that file can expose secrets even though no exfiltration intent is shown.
高
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database and writes merchant or expense records. That is sensitive database mutation in a financial workflow.
高
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database and writes merchant or expense records. That is sensitive database mutation in a financial workflow.
高
Personal and Nonprofit Financial Context Exposure
The skill includes real-looking names of ministry partners, workers, members, and gift recipients in a finance database context. This exposes personal or organizational financial context that should be anonymized before marketplace publication.
The cited lines list named people and organizations as categorized finance recipients. The names are visible in the skill text, so the privacy risk is direct.
高
Destructive Financial Database Workflow
The skill references a delete-expenses-by-date tool and database initialization guidance without requiring backups or explicit confirmation in the instruction text. An agent following this workflow could remove or reset financial records.
The referenced deletion and initialization commands are explicit and relate to expense data. The file does not provide strong safety gates around those operations.
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
顯示全部 15 條已確認問題
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
中
SQLite database file
2. Import database connection: `from app.db import get_connection`
Although the detector label says SQLite, the surrounding guidance uses app.db.get_connection against the nonprofit finance database. This can expose or modify financial records.
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
中
SQLite database file
python3 -c "from app.db import get_connection; print('✓ Database connection OK')"
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
中
SQLite database file
from app.db import get_connection
The surrounding code pattern opens the finance database for schema or expense queries. This can expose sensitive financial structure or records.
能力複核項目 (6)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Hidden file access
VENV_PATH=/home/adamsl/planner/.venv
The skill directs agents to a machine-specific hidden virtual environment under /home/adamsl/planner/.venv. That can cause host filesystem access outside the skill package.
中
Hidden file access
source /home/adamsl/planner/.venv/bin/activate
The skill directs agents to a machine-specific hidden virtual environment under /home/adamsl/planner/.venv. That can cause host filesystem access outside the skill package.
中
Hidden file access
source /home/adamsl/planner/.venv/bin/activate
The skill directs agents to a machine-specific hidden virtual environment under /home/adamsl/planner/.venv. That can cause host filesystem access outside the skill package.
中
Hidden file access
source /home/adamsl/planner/.venv/bin/activate
The skill directs agents to a machine-specific hidden virtual environment under /home/adamsl/planner/.venv. That can cause host filesystem access outside the skill package.
中
Hidden file access
**Fix**: `source /home/adamsl/planner/.venv/bin/activate`
The skill directs agents to a machine-specific hidden virtual environment under /home/adamsl/planner/.venv. That can cause host filesystem access outside the skill package.
中
Hidden file access
source /home/adamsl/planner/.venv/bin/activate
The skill directs agents to a machine-specific hidden virtual environment under /home/adamsl/planner/.venv. That can cause host filesystem access outside the skill package.
風險因素
⚙️ 外部命令 (58)
SKILL.md:15-21 SKILL.md:21-24 SKILL.md:24-26 SKILL.md:26-29 SKILL.md:29-31 SKILL.md:31-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-50 SKILL.md:50-72 SKILL.md:72-75 SKILL.md:75-102 SKILL.md:102-105 SKILL.md:105-122 SKILL.md:122-125 SKILL.md:125-135 SKILL.md:135-140 SKILL.md:140-177 SKILL.md:177-180 SKILL.md:180-195 SKILL.md:195-225 SKILL.md:225-231 SKILL.md:231-237 SKILL.md:237-238 SKILL.md:238-240 SKILL.md:240-241 SKILL.md:241-246 SKILL.md:246-253 SKILL.md:253-256 SKILL.md:256-259 SKILL.md:259-264 SKILL.md:264-277 SKILL.md:277-280 SKILL.md:280-293 SKILL.md:293-296 SKILL.md:296-319 SKILL.md:319-322 SKILL.md:322-347 SKILL.md:347-350 SKILL.md:350-368 SKILL.md:368-374 SKILL.md:374-378 SKILL.md:378-383 SKILL.md:383-384 SKILL.md:384-387 SKILL.md:387-390 SKILL.md:390-395 SKILL.md:395-400 SKILL.md:400-404 SKILL.md:404-407 SKILL.md:407-416 SKILL.md:416-419 SKILL.md:419-427
🌐 網路存取 (1)
📁 檔案系統存取 (6)
🔑 環境變數 (1)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/egadams-receipt-scanning-tools/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/egadams-receipt-scanning-tools?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/egadams-receipt-scanning-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/egadams-receipt-scanning-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/egadams-receipt-scanning-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
EGAdams. (2026). receipt-scanning-tools security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/egadams-receipt-scanning-tools/audits/8BibTeX 引用
@techreport{egadams-egadams-receipt-scanning-tools-2026,
author = {EGAdams},
title = {receipt-scanning-tools security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/egadams-receipt-scanning-tools/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "receipt-scanning-tools security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "EGAdams"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/egadams-receipt-scanning-tools/audits/8"
identifiers:
- type: other
value: "skillstore:egadams-receipt-scanning-tools:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
71
社群
83
規範符合度
你可以打造什麼
記錄非營利組織收據
使用手動輸入工作流程來選擇商家、日期、金額、類別，並儲存已確認的支出。
維護收據工具
使用結構描述註記和程式碼模式來修正查詢，或新增新的收據命令列工具。
檢視支出資料
在進行變更前，使用資料庫檢查命令來檢視近期支出、類別計數和連線狀態。
試試這些提示
開啟收據選單
使用此技能向我展示如何啟用專案環境並開啟收據工具選單。執行每個命令前先詢問。
輸入手動收據
引導我為非營利組織支出進行手動收據輸入。在儲存前詢問商家、金額、日期、類別和確認。
修正類別查詢
某個查詢因未知的 category_path 欄位而失敗。使用已記錄的結構描述來解釋問題，並提出更安全的類別路徑查詢。
規劃新的收據工具
為新的收據驗證命令列工具建立計畫，並遵循現有專案模式。在任何寫入操作前包含資料庫安全檢查和測試步驟。
最佳實務
- 執行任何會寫入、刪除或初始化資料庫記錄的命令前先確認。
- 將本機絕對路徑和範例名稱替換為目前專案中的值。
- 將憑證保存在本機祕密儲存中，並避免分享環境檔案內容。
避免
- 沒有備份和明確核准時，請勿執行資料庫刪除或初始化命令。
- 請勿將 API keys、資料庫密碼或環境檔案內容貼到聊天中。
- 請勿將結構描述範例視為生產環境欄位存在的證明。
常見問題
這項技能能協助什麼？
它協助使用者操作和疑難排解收據掃描、手動收據輸入，以及由資料庫支援的支出工作流程。
它會自動掃描收據嗎？
它記錄 OCR 設定和規劃中的上傳工作。目前指引著重於手動輸入和資料庫整合。
哪些 AI 工具可以使用它？
報告列出支援 Claude、Codex 和 Claude Code。
它是否包含收據工具原始碼？
不會。它參照專案指令碼，並提供使用或擴充這些指令碼的模式。
它需要哪些本機存取權？
它可能需要存取專案目錄、Python 環境、資料庫連線設定和 OCR API 設定。
我應該如何安全使用它？
執行前檢視命令，避免分享機密，並在寫入或刪除操作前備份財務資料。