Scan Report
5 /100
invoice-scan
AI-powered invoice OCR, scanning, and data extraction
The invoice-scan skill is a well-documented invoice OCR and data extraction tool with transparent behavior, clear privacy disclosures, and legitimate use of filesystem, network, and shell resources aligned with its declared purpose.
Safe to install
This skill is safe to use. Ensure users understand the privacy implications of CLI mode sending invoice data to Anthropic's API. Agent-native mode is recommended for privacy-sensitive environments.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Dependencies use caret ranges rather than pinned versions Supply Chain | scripts/package.json:35 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | WRITE | WRITE | ✓ Aligned | SKILL.md declares output file writes to {WORKSPACE}/invoice-scan/output/; code c… |
| Network | READ | READ | ✓ Aligned | SKILL.md declares external endpoint api.anthropic.com; scanner.js:195 confirms f… |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md declares npm install --production; package.json specifies sharp and xls… |
| Environment | READ | READ | ✓ Aligned | SKILL.md declares ANTHROPIC_API_KEY env var requirement; cli.js:47 reads from pr… |
| Skill Invoke | NONE | NONE | — | No inter-skill invocation observed |
| Clipboard | NONE | NONE | — | No clipboard access found in codebase |
| Browser | NONE | NONE | — | No browser automation present |
| Database | NONE | NONE | — | No database access found in codebase |
File Tree
21 files · 140.4 KB · 3726 lines JavaScript 17f · 3437L
Markdown 3f · 249L
JSON 1f · 40L
├─
▾
references
│ ├─
canonical-schema.md
Markdown
│ └─
validation-rules.md
Markdown
├─
▾
scripts
│ ├─
▾
adapters
│ │ ├─
base.js
JavaScript
│ │ ├─
claude.js
JavaScript
│ │ └─
index.js
JavaScript
│ ├─
▾
extraction
│ │ └─
scanner.js
JavaScript
│ ├─
▾
output
│ │ ├─
csv.js
JavaScript
│ │ ├─
excel.js
JavaScript
│ │ ├─
index.js
JavaScript
│ │ ├─
json.js
JavaScript
│ │ └─
prepare.js
JavaScript
│ ├─
▾
preprocessing
│ │ └─
preprocess.js
JavaScript
│ ├─
▾
schema
│ │ └─
canonical.js
JavaScript
│ ├─
▾
test
│ │ └─
run-tests.js
JavaScript
│ ├─
▾
validation
│ │ ├─
arithmetic.js
JavaScript
│ │ ├─
completeness.js
JavaScript
│ │ └─
document-rules.js
JavaScript
│ ├─
cli.js
JavaScript
│ ├─
index.js
JavaScript
│ └─
package.json
JSON
└─
SKILL.md
Markdown
Dependencies 2 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
sharp | ^0.33.0 | npm | No | libvips-based image processing library |
xlsx | ^0.18.5 | npm | No | Excel file generation library (SheetJS) |
Security Positives
✓ Agent-native mode performs ALL processing locally without any network access or external API calls
✓ Comprehensive privacy notice explicitly warns users about data transmission in CLI mode
✓ Clear documentation distinguishing between agent-native and CLI modes with their respective capabilities
✓ No credential harvesting — ANTHROPIC_API_KEY is only used for its declared purpose (authenticating to Claude API)
✓ No suspicious patterns: no base64 execution, no direct IP calls, no os.environ iteration, no curl|bash patterns
✓ Filesystem access is scoped to specific input files and a dedicated output directory
✓ Dependencies (sharp, xlsx) are well-known, stable image processing libraries
✓ No hidden functionality or shadow behavior — code matches documentation
✓ Comprehensive validation pipeline (arithmetic, document rules, schema, completeness) suggests a professional, legitimate project